lua-cli 3.32.2 → 3.32.3

package/dist/index.js

@@ -64,6 +64,261 @@ var init_auth_error = __esm({
   }
 });
 
+// src/errors/cli.error.ts
+function isAccessDeniedError(error) {
+  if (CliError.isCliError(error)) return error.statusCode === 403;
+  return error instanceof Error && error.message.startsWith("Access denied (403)");
+}
+function isHandledCliError(error) {
+  return error instanceof HandledCliError || typeof error === "object" && error !== null && error.handled === true && typeof error.exitCode === "number";
+}
+function setDebugMode(enabled) {
+  debugFlag = enabled;
+}
+function debugEnabled() {
+  const v = process.env.LUA_DEBUG;
+  return debugFlag || v === "1" || v === "true" || v === "yes";
+}
+function authHint(error) {
+  if (error.suppressDefaultRemediation) return void 0;
+  if (error.reason === "no_agent_access") {
+    return [
+      "Your API key is valid, but it does not have access to the agentId in lua.skill.yaml \u2014 the agent belongs",
+      "to another account or organization, was deleted or transferred, or the yaml was copied from another project.",
+      "Check the configured agent and switch if needed:",
+      "  lua agents          (list agents you have access to)",
+      "  lua init            (re-select the agent for this project)"
+    ].join("\n");
+  }
+  return "Re-authenticate or check your API key: lua auth configure \xB7 https://admin.heylua.ai";
+}
+function numericStatus(error) {
+  const candidate = error.statusCode ?? error.status;
+  return typeof candidate === "number" && Number.isFinite(candidate) ? candidate : void 0;
+}
+function classifyCliError(error) {
+  if (CliError.isCliError(error)) {
+    return {
+      code: error.code,
+      exitCode: error.exitCode,
+      message: error.message,
+      hint: error.hint
+    };
+  }
+  if (AuthenticationError.isAuthenticationError(error)) {
+    return {
+      code: "auth",
+      exitCode: CLI_EXIT.AUTH,
+      message: error.message,
+      hint: authHint(error)
+    };
+  }
+  const e = typeof error === "object" && error !== null ? error : {};
+  const message = typeof e.message === "string" && e.message.length > 0 ? e.message : error instanceof Error ? error.name : String(error ?? "Unknown error");
+  if (e.name === "WorkflowLocalUsageError" || typeof e.code === "string" && e.code.startsWith("commander.")) {
+    return {
+      code: "usage",
+      exitCode: CLI_EXIT.USAGE,
+      message
+    };
+  }
+  const status = numericStatus(e);
+  if (status !== void 0) {
+    if (status === 401) return {
+      code: "auth",
+      exitCode: CLI_EXIT.AUTH,
+      message
+    };
+    if (status === 403) return {
+      code: "forbidden",
+      exitCode: CLI_EXIT.FORBIDDEN,
+      message
+    };
+    if (status === 404) return {
+      code: "not_found",
+      exitCode: CLI_EXIT.NOT_FOUND,
+      message
+    };
+    if (status >= 400 && status < 500) return {
+      code: `http_${status}`,
+      exitCode: CLI_EXIT.FORBIDDEN,
+      message
+    };
+    if (status >= 500 || status === 0) return {
+      code: "unavailable",
+      exitCode: CLI_EXIT.UNAVAILABLE,
+      message
+    };
+  }
+  const causeCode = e.cause?.code;
+  if (typeof e.code === "string" && NETWORK_ERRNO.has(e.code) || typeof causeCode === "string" && NETWORK_ERRNO.has(causeCode) || e.name === "AbortError" || e.name === "TimeoutError" || NETWORK_MESSAGE.test(message)) {
+    return {
+      code: "unavailable",
+      exitCode: CLI_EXIT.UNAVAILABLE,
+      message,
+      hint: UNAVAILABLE_HINT
+    };
+  }
+  return {
+    code: "error",
+    exitCode: CLI_EXIT.ERROR,
+    message
+  };
+}
+function renderCliError(reported, options = {}) {
+  const lines = [
+    `\u2716 ${reported.code}: ${reported.message}`
+  ];
+  for (const hint of [
+    reported.hint,
+    options.extraHint
+  ]) {
+    if (!hint) continue;
+    hint.split("\n").forEach((line, i) => lines.push(i === 0 ? `\u{1F4A1} ${line}` : `   ${line}`));
+  }
+  if (options.stack) lines.push("", options.stack);
+  return lines;
+}
+function reportCliError(error, options = {}) {
+  const reported = classifyCliError(error);
+  const stack = debugEnabled() && error instanceof Error ? error.stack : void 0;
+  for (const line of renderCliError(reported, {
+    extraHint: options.extraHint,
+    stack
+  })) console.error(line);
+  return reported;
+}
+function commanderExitCode(error) {
+  const e = error;
+  const code = e?.code;
+  if (typeof code !== "string" || !code.startsWith("commander.")) return void 0;
+  if (code === "commander.helpDisplayed" || code === "commander.version") return CLI_EXIT.OK;
+  if (code === "commander.help") return e?.exitCode === 0 ? CLI_EXIT.OK : CLI_EXIT.USAGE;
+  return CLI_EXIT.USAGE;
+}
+function reportUnhandledCliError(error) {
+  if (isHandledCliError(error)) {
+    process.exitCode = error.exitCode;
+    return error.exitCode;
+  }
+  const commander = commanderExitCode(error);
+  if (commander !== void 0) {
+    process.exitCode = commander;
+    return commander;
+  }
+  const reported = reportCliError(error);
+  process.exitCode = reported.exitCode;
+  return reported.exitCode;
+}
+var CLI_EXIT, CliError, HandledCliError, debugFlag, NETWORK_ERRNO, NETWORK_MESSAGE, UNAVAILABLE_HINT, CLI_EXIT_CODE_HELP;
+var init_cli_error = __esm({
+  "src/errors/cli.error.ts"() {
+    "use strict";
+    init_auth_error();
+    CLI_EXIT = {
+      OK: 0,
+      ERROR: 1,
+      USAGE: 2,
+      NOT_FOUND: 3,
+      AUTH: 9,
+      FORBIDDEN: 10,
+      UNAVAILABLE: 11
+    };
+    CliError = class _CliError extends Error {
+      static {
+        __name(this, "CliError");
+      }
+      isCliError = true;
+      code;
+      exitCode;
+      hint;
+      statusCode;
+      constructor(code, message, options = {}) {
+        super(message);
+        this.name = "CliError";
+        this.code = code;
+        this.exitCode = options.exitCode ?? CLI_EXIT.ERROR;
+        this.hint = options.hint;
+        this.statusCode = options.statusCode;
+        if (Error.captureStackTrace) Error.captureStackTrace(this, _CliError);
+      }
+      /** Bad arguments, an unknown action, no project — exit 2. */
+      static usage(message, hint) {
+        return new _CliError("usage", message, {
+          exitCode: CLI_EXIT.USAGE,
+          hint
+        });
+      }
+      /** The named thing does not exist — exit 3. */
+      static notFound(message, hint) {
+        return new _CliError("not_found", message, {
+          exitCode: CLI_EXIT.NOT_FOUND,
+          hint,
+          statusCode: 404
+        });
+      }
+      /** The credential may not do this — exit 10. */
+      static forbidden(message, hint) {
+        return new _CliError("forbidden", message, {
+          exitCode: CLI_EXIT.FORBIDDEN,
+          hint,
+          statusCode: 403
+        });
+      }
+      static isCliError(error) {
+        return error instanceof _CliError || typeof error === "object" && error !== null && error.isCliError === true;
+      }
+    };
+    __name(isAccessDeniedError, "isAccessDeniedError");
+    HandledCliError = class extends Error {
+      static {
+        __name(this, "HandledCliError");
+      }
+      handled = true;
+      exitCode;
+      /** The error that was reported. */
+      original;
+      constructor(message, exitCode, original) {
+        super(message);
+        this.name = "HandledCliError";
+        this.exitCode = exitCode;
+        this.original = original;
+      }
+    };
+    __name(isHandledCliError, "isHandledCliError");
+    debugFlag = false;
+    __name(setDebugMode, "setDebugMode");
+    __name(debugEnabled, "debugEnabled");
+    NETWORK_ERRNO = /* @__PURE__ */ new Set([
+      "ECONNREFUSED",
+      "ECONNRESET",
+      "ENOTFOUND",
+      "ETIMEDOUT",
+      "EAI_AGAIN",
+      "EPIPE",
+      "EHOSTUNREACH",
+      "ENETUNREACH",
+      "UND_ERR_CONNECT_TIMEOUT",
+      "UND_ERR_HEADERS_TIMEOUT",
+      "UND_ERR_BODY_TIMEOUT",
+      "UND_ERR_SOCKET"
+    ]);
+    NETWORK_MESSAGE = /fetch failed|socket hang up|network request failed|request timeout|ECONNREFUSED|ENOTFOUND/i;
+    UNAVAILABLE_HINT = "The Lua API could not be reached \u2014 check your network and https://status.heylua.ai, then retry.";
+    __name(authHint, "authHint");
+    __name(numericStatus, "numericStatus");
+    __name(classifyCliError, "classifyCliError");
+    __name(renderCliError, "renderCliError");
+    __name(reportCliError, "reportCliError");
+    __name(commanderExitCode, "commanderExitCode");
+    __name(reportUnhandledCliError, "reportUnhandledCliError");
+    CLI_EXIT_CODE_HELP = `Exit codes: 0 ok \xB7 1 error \xB7 2 usage \xB7 3 not found \xB7 9 auth (401) \xB7 10 forbidden (403 / other 4xx) \xB7
+            11 unavailable (5xx / network). lua workflows adds 4 run failed \xB7 5 run cancelled \xB7 6 run gated \xB7
+            7 --timeout reached \xB7 8 run parked waiting for a human.
+Errors:     one line \u2014 \u2716 <code>: <message> \u2014 plus a \u{1F4A1} hint; LUA_DEBUG=1 prints the stack.`;
+  }
+});
+
 // src/utils/semver.ts
 function parseVersion(version) {
   const [versionPart, preReleasePart] = version.split("-");
@@ -998,6 +1253,48 @@ function scheduledTimeKey(scheduledTime) {
 function scheduledWorkflowRunIdForTime(jobId, scheduledTime) {
   return scheduledWorkflowRunId(jobId, scheduledTime);
 }
+function workflowRetryMaxAttemptsMessage(got) {
+  const tail = got === void 0 ? "" : ` (got ${JSON.stringify(got)})`;
+  return `\`retry.maxAttempts\` must be an integer ${WORKFLOW_RETRY_MIN_ATTEMPTS}..${WORKFLOW_RETRY_MAX_ATTEMPTS}${tail}`;
+}
+function isWithinWorkflowRetryAttempts(value3) {
+  return typeof value3 === "number" && Number.isInteger(value3) && value3 >= WORKFLOW_RETRY_MIN_ATTEMPTS && value3 <= WORKFLOW_RETRY_MAX_ATTEMPTS;
+}
+function workflowRetryUnknownMembersMessage(keys) {
+  const named = keys.map((k) => {
+    const engine = WORKFLOW_RETRY_ENGINE_KEYS.includes(k);
+    return `\`${k}\`${engine ? " (engine-owned \u2014 stamped by resetAttempts, never authored)" : ""}`;
+  });
+  return `\`retry\` has no member ${named.join(", ")}; members: ${WORKFLOW_RETRY_POLICY_KEYS.join(", ")}`;
+}
+function unknownWorkflowRetryMembers(retry) {
+  if (!retry || typeof retry !== "object" || Array.isArray(retry)) return [];
+  return Object.keys(retry).filter((k) => !WORKFLOW_RETRY_POLICY_KEYS.includes(k));
+}
+function authoredRetryPolicy(retry) {
+  if (!retry || typeof retry !== "object" || Array.isArray(retry)) return void 0;
+  const src = retry;
+  const out = {};
+  for (const k of WORKFLOW_RETRY_POLICY_KEYS) if (src[k] !== void 0) out[k] = src[k];
+  return Object.keys(out).length ? out : void 0;
+}
+function retryBudgetBaseAttempt(row2) {
+  const base = row2.retry?.budgetBaseAttempt;
+  return typeof base === "number" && Number.isSafeInteger(base) && base > 0 ? base : 0;
+}
+function retryBudgetAttempt(row2) {
+  return Math.max(0, row2.attempt - retryBudgetBaseAttempt(row2));
+}
+function retryBudgetMaxAttempts(row2) {
+  const max = row2.retry?.maxAttempts;
+  return typeof max === "number" && Number.isFinite(max) && max >= 1 ? max : 1;
+}
+function retryBudgetRemaining(row2) {
+  return retryBudgetAttempt(row2) < retryBudgetMaxAttempts(row2);
+}
+function retriesRemaining(row2) {
+  return Math.max(0, retryBudgetMaxAttempts(row2) - retryBudgetAttempt(row2));
+}
 function isWithinWorkflowJobRange(member, value3) {
   const { min, max } = WORKFLOW_JOB_RANGES[member];
   return typeof value3 === "number" && Number.isInteger(value3) && value3 >= min && value3 <= max;
@@ -1185,7 +1482,66 @@ ${PREAMBLE}
 
 ${items.join("\n\n")}`;
 }
-var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE;
+function workflowApprovalDecisionOf(resumeData) {
+  if (resumeData.timedOut === true) return "timed_out";
+  return resumeData.approved === true ? "approved" : "denied";
+}
+function workflowApprovalOutput(resumeData) {
+  const decision = typeof resumeData.decision === "string" ? resumeData.decision : workflowApprovalDecisionOf(resumeData);
+  const note = typeof resumeData.note === "string" && resumeData.note.trim() !== "" ? resumeData.note : void 0;
+  const text = typeof resumeData.text === "string" ? resumeData.text : note ?? decision;
+  return {
+    ...resumeData,
+    decision,
+    text
+  };
+}
+function isWorkflowApprovalOutput(value3) {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3)) return false;
+  const v = value3;
+  return typeof v.approved === "boolean" && WORKFLOW_APPROVAL_OUTPUT_DECISIONS.includes(v.decision) && typeof v.text === "string";
+}
+function extractSingleJsonValue(text) {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed) return {
+    reason: "reply is empty"
+  };
+  const fenced = [
+    ...trimmed.matchAll(JSON_FENCE_RE)
+  ];
+  if (fenced.length > 1) return {
+    reason: "reply carries more than one fenced block"
+  };
+  const candidate = fenced.length === 1 ? fenced[0][1].trim() : trimmed;
+  try {
+    return {
+      value: JSON.parse(candidate)
+    };
+  } catch {
+    if (fenced.length === 1) return {
+      reason: "fenced block is not valid JSON"
+    };
+  }
+  const opens = [
+    trimmed.indexOf("{"),
+    trimmed.indexOf("[")
+  ].filter((i) => i !== -1);
+  const start = opens.length ? Math.min(...opens) : -1;
+  const end = Math.max(trimmed.lastIndexOf("}"), trimmed.lastIndexOf("]"));
+  if (start === -1 || end <= start) return {
+    reason: "reply is not JSON"
+  };
+  try {
+    return {
+      value: JSON.parse(trimmed.slice(start, end + 1))
+    };
+  } catch {
+    return {
+      reason: "reply does not contain a single JSON value"
+    };
+  }
+}
+var __defProp2, __name2, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, PLATFORM_FALLBACK_MODEL_SOURCE, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, AGENT_LOG_SOURCES, CORE_DRAINING_CODE, CORE_DRAINING_DEFAULT_RETRY_MS, CORE_DRAINING_MAX_RETRY_MS, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, EventType, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, TYPED_API_KEY, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema, SYSTEM_USER_PREFIX, WORKFLOW_RUN_IN_FLIGHT, WORKFLOW_RUN_IDLE, WORKFLOW_RUN_TERMINAL, WORKFLOW_RUN_STATUSES, WORKFLOW_STEP_STATUSES, WORKFLOW_STEP_IN_FLIGHT, ARCHIVE_WINDOW_MARGIN_DAYS, WORKFLOW_ORG_PURGING_TTL_S, WORKFLOW_ORG_PURGE_FORCE_AFTER_MS, IDEMPOTENCY_HOLDING_STATUSES, WORKFLOW_SCHEDULED_RUN_ID_PREFIX, CLOUD_TASK_RUN_ID_PREFIX, WORKFLOW_OPERATION_ID_PREFIX, WORKFLOW_JOURNAL_PROTOCOL_VERSION, WORKFLOW_CONNECTION_KEY_RE, WORKFLOW_SIGNAL_PAYLOAD_MAX_BYTES, WORKFLOW_RESOLVE_OUTPUT_MAX_BYTES, WORKFLOW_RETRY_BACKOFFS, WORKFLOW_RETRY_MIN_ATTEMPTS, WORKFLOW_RETRY_POLICY_KEYS, WORKFLOW_RETRY_MAX_ATTEMPTS, WORKFLOW_RETRY_ENGINE_KEYS, WORKFLOW_JOB_RESOURCES, WORKFLOW_SIDE_EFFECTS, WORKFLOW_JOB_RANGES, WORKFLOW_JOB_RANGE_MEMBERS, WORKFLOW_SINGLE_STEP_TYPES, WORKFLOW_HITL_ENTRY_TYPES, WORKFLOW_ARM_ENTRY_TYPES, WORKFLOW_HITL_ARM_CONTAINERS, WORKFLOW_GRAPH_ENTRY_STEP_KINDS, WORKFLOW_ARM_ENTRY_STEP_KINDS, WORKFLOW_BUDGET_MAX_DURATION_SECONDS, REDACTED_PLACEHOLDER, PROVIDER_MESSAGE_MAX_CHARS, ERROR_MESSAGE_MAX_CHARS, SECRET_LITERAL_PATTERNS, SECRET_NAME, SECRET_PAIR_PATTERNS, GROUP_COUNT, WORKFLOW_SECRET_KEY_RE, WORKFLOW_RESERVED_SECRET_KEYS, SCRUB_INPUT_MAX_CHARS, SCRUB_CUT_BACKOFF_CHARS, WORKFLOW_AUDIT_EVENTS, WORKFLOW_AUDIT_METADATA_MAX_BYTES, INDENT, WRAP_WIDTH, NOUNS, GET_TOOL_NAMES, PREAMBLE, WORKFLOW_APPROVAL_OUTPUT_DECISIONS, WORKFLOW_APPROVAL_OUTPUT_SCHEMA, JSON_FENCE_RE;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -2306,6 +2662,37 @@ This text is who you are for this person. As you learn them, their name, their w
       "fixed",
       "exponential"
     ];
+    WORKFLOW_RETRY_MIN_ATTEMPTS = 1;
+    WORKFLOW_RETRY_POLICY_KEYS = [
+      "maxAttempts",
+      "backoffSeconds",
+      "backoff",
+      "maxBackoffSeconds"
+    ];
+    WORKFLOW_RETRY_MAX_ATTEMPTS = 20;
+    __name(workflowRetryMaxAttemptsMessage, "workflowRetryMaxAttemptsMessage");
+    __name2(workflowRetryMaxAttemptsMessage, "workflowRetryMaxAttemptsMessage");
+    __name(isWithinWorkflowRetryAttempts, "isWithinWorkflowRetryAttempts");
+    __name2(isWithinWorkflowRetryAttempts, "isWithinWorkflowRetryAttempts");
+    WORKFLOW_RETRY_ENGINE_KEYS = [
+      "budgetBaseAttempt"
+    ];
+    __name(workflowRetryUnknownMembersMessage, "workflowRetryUnknownMembersMessage");
+    __name2(workflowRetryUnknownMembersMessage, "workflowRetryUnknownMembersMessage");
+    __name(unknownWorkflowRetryMembers, "unknownWorkflowRetryMembers");
+    __name2(unknownWorkflowRetryMembers, "unknownWorkflowRetryMembers");
+    __name(authoredRetryPolicy, "authoredRetryPolicy");
+    __name2(authoredRetryPolicy, "authoredRetryPolicy");
+    __name(retryBudgetBaseAttempt, "retryBudgetBaseAttempt");
+    __name2(retryBudgetBaseAttempt, "retryBudgetBaseAttempt");
+    __name(retryBudgetAttempt, "retryBudgetAttempt");
+    __name2(retryBudgetAttempt, "retryBudgetAttempt");
+    __name(retryBudgetMaxAttempts, "retryBudgetMaxAttempts");
+    __name2(retryBudgetMaxAttempts, "retryBudgetMaxAttempts");
+    __name(retryBudgetRemaining, "retryBudgetRemaining");
+    __name2(retryBudgetRemaining, "retryBudgetRemaining");
+    __name(retriesRemaining, "retriesRemaining");
+    __name2(retriesRemaining, "retriesRemaining");
     WORKFLOW_JOB_RESOURCES = [
       "small",
       "medium",
@@ -2578,6 +2965,8 @@ This text is who you are for this person. As you learn them, their name, their w
       "workflow.goal.resumed",
       "workflow.goal.done",
       "workflow.goal.closed",
+      // LUA-760: an ended goal's cadence Job retired (deleted) — inline on done / closed, by R21 / R28, or by sweep #30
+      "workflow.goal.job_retired",
       // --- org policy (02 §2.10 / 09 R23) ---
       "workflow.policy.retention_changed",
       "workflow.policy.pacing_changed",
@@ -2627,6 +3016,79 @@ listed here; never invent a target.`;
     __name2(reachingIt, "reachingIt");
     __name(renderTargetsBlock, "renderTargetsBlock");
     __name2(renderTargetsBlock, "renderTargetsBlock");
+    WORKFLOW_APPROVAL_OUTPUT_DECISIONS = [
+      "approved",
+      "denied",
+      "timed_out"
+    ];
+    WORKFLOW_APPROVAL_OUTPUT_SCHEMA = {
+      type: "object",
+      properties: {
+        approved: {
+          type: "boolean"
+        },
+        decision: {
+          type: "string",
+          enum: [
+            ...WORKFLOW_APPROVAL_OUTPUT_DECISIONS
+          ]
+        },
+        /** the approver's note when given, else the decision word — what `${stepResults.<id>.text}` reads */
+        text: {
+          type: "string"
+        },
+        note: {
+          type: "string"
+        },
+        editedPayload: {},
+        editRevision: {
+          type: "integer"
+        },
+        decidedBy: {
+          type: "object",
+          properties: {
+            id: {
+              type: "string"
+            },
+            kind: {
+              type: "string"
+            }
+          }
+        },
+        timedOut: {
+          type: "boolean"
+        },
+        escalations: {
+          type: "integer"
+        },
+        evidence: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        },
+        items: {
+          type: "array",
+          items: {
+            type: "object"
+          }
+        }
+      },
+      required: [
+        "approved",
+        "decision",
+        "text"
+      ]
+    };
+    __name(workflowApprovalDecisionOf, "workflowApprovalDecisionOf");
+    __name2(workflowApprovalDecisionOf, "workflowApprovalDecisionOf");
+    __name(workflowApprovalOutput, "workflowApprovalOutput");
+    __name2(workflowApprovalOutput, "workflowApprovalOutput");
+    __name(isWorkflowApprovalOutput, "isWorkflowApprovalOutput");
+    __name2(isWorkflowApprovalOutput, "isWorkflowApprovalOutput");
+    JSON_FENCE_RE = /```(?:json)?[ \t]*\r?\n([\s\S]*?)\r?\n?```/g;
+    __name(extractSingleJsonValue, "extractSingleJsonValue");
+    __name2(extractSingleJsonValue, "extractSingleJsonValue");
   }
 });
 
@@ -3133,6 +3595,208 @@ import { createHash as createHash2 } from "crypto";
 import { z as z6 } from "zod";
 import { z as z22 } from "zod";
 import { createHash as createHash22 } from "crypto";
+function isMapConfigObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseMapConfig(raw, stepId) {
+  if (isMapConfigObject(raw)) return raw;
+  if (typeof raw !== "string") {
+    throw new Error(`Stored mapping step "${stepId}" has a mapConfig that is neither a JSON string nor an object.`);
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (e) {
+    throw new Error(`Stored mapping step "${stepId}" has invalid JSON mapConfig: ${e.message}`);
+  }
+}
+function mapConfigWire(raw) {
+  if (typeof raw === "string") return raw;
+  if (isMapConfigObject(raw)) return canonicalJson(raw);
+  return void 0;
+}
+function describeBadPlaceholder(template22, idx, rawExpr) {
+  return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
+}
+function parseTemplatePlaceholder(rawExpr) {
+  const dot = rawExpr.indexOf(".");
+  return {
+    scope: dot === -1 ? rawExpr : rawExpr.slice(0, dot),
+    rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
+  };
+}
+function traverseMappingPath(root, path25, errorLabel2) {
+  if (path25 === "" || path25 === ".") return root;
+  const parts = path25.split(".");
+  let value22 = root;
+  for (const part of parts) {
+    if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
+    else throw new WorkflowTemplateError(`Invalid path ${path25} in ${errorLabel2}`, path25);
+  }
+  return value22;
+}
+function stringifyTemplateValue(v, template22, idx, rawExpr) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "object") {
+    try {
+      return JSON.stringify(v);
+    } catch (err) {
+      throw new WorkflowTemplateError(`${describeBadPlaceholder(template22, idx, rawExpr)} resolved to a value that could not be JSON-stringified (${err.message}).`, rawExpr);
+    }
+  }
+  return String(v);
+}
+function escapeFence(content) {
+  return content.replace(/<\/lua-data/g, "<\\/lua-data");
+}
+function fenceBlock(name, source, content) {
+  return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
+}
+function renderTemplate(template22, ctx, opts) {
+  let idx = 0;
+  return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
+    idx += 1;
+    const { scope, rest } = parseTemplatePlaceholder(rawExpr);
+    const label = describeBadPlaceholder(template22, idx, rawExpr);
+    let rendered;
+    let source;
+    switch (scope) {
+      case "initData":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.initData, rest, label), template22, idx, rawExpr);
+        source = "initData";
+        break;
+      case "state":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.state, rest, label), template22, idx, rawExpr);
+        source = "state";
+        break;
+      case "requestContext":
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.requestContext, rest, label), template22, idx, rawExpr);
+        source = "requestContext";
+        break;
+      case "stepResults": {
+        const innerDot = rest.indexOf(".");
+        const stepId = innerDot === -1 ? rest : rest.slice(0, innerDot);
+        const subPath = innerDot === -1 ? "" : rest.slice(innerDot + 1);
+        if (!stepId) throw new WorkflowTemplateError(`${label} must name a step: \${stepResults.<stepId>.<path>}.`, rawExpr);
+        if (!(stepId in ctx.stepResults) || ctx.stepResults[stepId] == null) {
+          throw new WorkflowTemplateError(`${label} references stepResults.${stepId} but step "${stepId}" has no resolvable output (not an ancestor, not run, failed, or produced no output).`, rawExpr);
+        }
+        rendered = stringifyTemplateValue(traverseMappingPath(ctx.stepResults[stepId], subPath, label), template22, idx, rawExpr);
+        source = `step:${stepId}`;
+        break;
+      }
+      default:
+        throw new WorkflowTemplateError(`${label} references unknown namespace "${scope}". Use one of: ${TEMPLATE_NAMESPACES.join(", ")}.`, rawExpr);
+    }
+    return opts.fenced ? fenceBlock(rawExpr, source, rendered) : rendered;
+  });
+}
+function isMapDescriptor(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  const d = v;
+  const keys = Object.keys(d);
+  const only = /* @__PURE__ */ __name3((...allowed) => keys.every((k) => allowed.includes(k)), "only");
+  if ("value" in d) return keys.length === 1;
+  if ("template" in d) return keys.length === 1 && typeof d.template === "string";
+  if ("requestContextPath" in d) return keys.length === 1 && typeof d.requestContextPath === "string";
+  if ("knowledge" in d) return keys.length === 1 && typeof d.knowledge === "object" && d.knowledge !== null;
+  if ("initData" in d) return d.initData === true && typeof d.path === "string" && only("initData", "path");
+  if ("step" in d) {
+    const stepOk = typeof d.step === "string" || Array.isArray(d.step) && d.step.every((x) => typeof x === "string");
+    return stepOk && typeof d.path === "string" && only("step", "path", "rows");
+  }
+  return false;
+}
+function malformedMapMembers(cfg) {
+  if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) return [];
+  const out = [];
+  for (const [member, v] of Object.entries(cfg)) {
+    if (!v || typeof v !== "object" || Array.isArray(v) || isMapDescriptor(v)) continue;
+    const keys = Object.keys(v).filter((k) => MAP_DESCRIPTOR_KEYS.includes(k));
+    if (keys.length > 0) out.push({
+      member,
+      keys
+    });
+  }
+  return out;
+}
+function mapMemberMalformedMessage(id, m) {
+  const keys = m.keys.map((k) => `\`${k}\``).join(", ");
+  return `"${id}".${m.member} carries descriptor key${m.keys.length === 1 ? "" : "s"} ${keys} but is not an exact binding form ({initData:true, path} | {step, path[, rows]} | {value} | {template} | {requestContextPath} | {knowledge}) \u2014 it is passed to the step verbatim as a literal; fix the descriptor, or wrap it in {value: \u2026} if the literal is intended`;
+}
+function resolveDescriptor(key, m, ctx) {
+  if (!isMapDescriptor(m)) return {
+    value: m
+  };
+  try {
+    if ("value" in m) return {
+      value: m.value
+    };
+    if ("template" in m && typeof m.template === "string") {
+      return {
+        value: renderTemplate(m.template, ctx, {
+          fenced: false
+        })
+      };
+    }
+    if ("knowledge" in m || "rows" in m && m.rows !== void 0) {
+      return {
+        error: "binding_unresolved",
+        key
+      };
+    }
+    if ("requestContextPath" in m) {
+      const label = `requestContext path for key "${key}"`;
+      return {
+        value: traverseMappingPath(ctx.requestContext, m.requestContextPath, label)
+      };
+    }
+    if ("path" in m) {
+      const source = "initData" in m && m.initData ? "initData" : "step";
+      if (source === "initData") {
+        return {
+          value: traverseMappingPath(ctx.initData, m.path, `initData for key "${key}"`)
+        };
+      }
+      const stepRef = m.step;
+      const candidates = Array.isArray(stepRef) ? stepRef : [
+        stepRef
+      ];
+      const stepId = candidates.find((s) => ctx.stepResults[s] !== void 0 && ctx.stepResults[s] !== null);
+      if (stepId === void 0) return {
+        error: "binding_unresolved",
+        key
+      };
+      return {
+        value: traverseMappingPath(ctx.stepResults[stepId], m.path, `step ${candidates.join("|")} for key "${key}"`)
+      };
+    }
+    return {
+      error: "binding_unresolved",
+      key
+    };
+  } catch (err) {
+    if (err instanceof WorkflowTemplateError) return {
+      error: "binding_unresolved",
+      key
+    };
+    throw err;
+  }
+}
+function resolveMapping(cfg, ctx) {
+  const keys = Object.keys(cfg);
+  if (keys.length === 1 && keys[0] === "") {
+    return resolveDescriptor("", cfg[""], ctx);
+  }
+  const result = {};
+  for (const key of keys) {
+    const resolved = resolveDescriptor(key, cfg[key], ctx);
+    if ("error" in resolved) return resolved;
+    result[key] = resolved.value;
+  }
+  return {
+    value: result
+  };
+}
 function workspaceTemplatePath(template22) {
   const key = template22.trim();
   const expr = WORKSPACE_TEMPLATE_EXPR_RE.exec(key);
@@ -3293,12 +3957,11 @@ function mapConfigStepRefs(raw) {
   if (!cfg) return [];
   const ids = [];
   for (const d of Object.values(cfg)) {
-    if (!d || typeof d !== "object") continue;
-    const desc = d;
-    if (desc.step !== void 0) ids.push(...Array.isArray(desc.step) ? desc.step : [
-      desc.step
+    if (!isMapDescriptor(d)) continue;
+    if ("step" in d) ids.push(...Array.isArray(d.step) ? d.step : [
+      d.step
     ]);
-    if (typeof desc.template === "string") ids.push(...templateStepRefs(desc.template));
+    if ("template" in d) ids.push(...templateStepRefs(d.template));
   }
   return ids;
 }
@@ -3423,6 +4086,12 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const r = node.retry;
     if (!r) return;
     const id = singleId(node);
+    const unknown = unknownWorkflowRetryMembers(r);
+    if (unknown.length) err("invalid-envelope", workflowRetryUnknownMembersMessage(unknown), `${path25}.retry`, id);
+    if (r.maxAttempts !== void 0 && !isWithinWorkflowRetryAttempts(r.maxAttempts)) {
+      const over = typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS;
+      err(over ? "cap-exceeded" : "invalid-envelope", workflowRetryMaxAttemptsMessage(r.maxAttempts), `${path25}.retry.maxAttempts`, id);
+    }
     const backoffs = retryBackoffs();
     if (r.backoff !== void 0 && !backoffs.includes(r.backoff)) {
       const list = backoffs.map((b) => `'${b}'`).join(" | ");
@@ -3565,6 +4234,21 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     const schema = node.type === "step" ? node.step.outputSchema : node.type === "agent" ? node.outputSchema : void 0;
     if (schema !== void 0) outputSchemas.set(singleId(node), schema);
   }, "recordOutputSchema");
+  const checkMapMembers = /* @__PURE__ */ __name3((cfg, basePath, id) => {
+    for (const m of malformedMapMembers(cfg)) {
+      warn(MAP_MEMBER_MALFORMED_CODE, mapMemberMalformedMessage(id, m), `${basePath}.${m.member}`, id);
+    }
+  }, "checkMapMembers");
+  const checkInputShape = /* @__PURE__ */ __name3((node, path25) => {
+    if (node.type !== "tool" && node.type !== "workflow") return;
+    const input = node.input;
+    if (input === void 0) return;
+    if (input !== null && typeof input === "object" && !Array.isArray(input)) {
+      checkMapMembers(input, `${path25}.input`, node.id);
+      return;
+    }
+    err("invalid-envelope", `\`input\` must be an object map \u2014 each member a binding descriptor ({initData:true, path} | {step, path} | {value} | {template} | {requestContextPath}) or a JSON literal (got ${JSON.stringify(input)})`, `${path25}.input`, node.id);
+  }, "checkInputShape");
   const checkSingle = /* @__PURE__ */ __name3((node, path25, depth) => {
     recordOutputSchema(node);
     if (node.type === "workflow" && node.workflowId === WORKFLOW_ARM_SUBRUN_ID) {
@@ -3592,6 +4276,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
     }
     checkId(singleId(node), path25);
     checkPolicyEnums(node, path25);
+    checkInputShape(node, path25);
     checkTimeout(node, path25);
     checkTier(node, path25);
     checkRetry(node, path25);
@@ -3672,6 +4357,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
   const checkArm = /* @__PURE__ */ __name3((arm, path25, depth, container) => {
     if (arm.type === "mapping") {
       checkId(arm.id, path25);
+      checkMapMembers(readMapConfig(arm.mapConfig), `${path25}.mapConfig`, arm.id);
       for (const ref of nodeStepRefs(arm)) {
         if (!upstream.has(ref)) err("template-reference-unresolved", `"${arm.id}" references stepResults.${ref}, which is not upstream`, path25, arm.id);
       }
@@ -3696,6 +4382,7 @@ function validateLuaExtensions(g, caps = WORKFLOW_CAPS_DEFAULT, opts = {
         break;
       case "mapping":
         checkId(entry.id, path25);
+        checkMapMembers(readMapConfig(entry.mapConfig), `${path25}.mapConfig`, entry.id);
         for (const ref of nodeStepRefs(entry)) {
           if (!upstream.has(ref)) err("template-reference-unresolved", `"${entry.id}" references stepResults.${ref}, which is not upstream`, path25, entry.id);
         }
@@ -4294,172 +4981,6 @@ function toPathOrLiteral(v) {
     literal: v
   };
 }
-function isMapConfigObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function parseMapConfig(raw, stepId) {
-  if (isMapConfigObject(raw)) return raw;
-  if (typeof raw !== "string") {
-    throw new Error(`Stored mapping step "${stepId}" has a mapConfig that is neither a JSON string nor an object.`);
-  }
-  try {
-    return JSON.parse(raw);
-  } catch (e) {
-    throw new Error(`Stored mapping step "${stepId}" has invalid JSON mapConfig: ${e.message}`);
-  }
-}
-function mapConfigWire(raw) {
-  if (typeof raw === "string") return raw;
-  if (isMapConfigObject(raw)) return canonicalJson(raw);
-  return void 0;
-}
-function describeBadPlaceholder(template22, idx, rawExpr) {
-  return `Template placeholder #${idx} (\${${rawExpr}}) in '${template22}'`;
-}
-function parseTemplatePlaceholder(rawExpr) {
-  const dot = rawExpr.indexOf(".");
-  return {
-    scope: dot === -1 ? rawExpr : rawExpr.slice(0, dot),
-    rest: dot === -1 ? "" : rawExpr.slice(dot + 1)
-  };
-}
-function traverseMappingPath(root, path25, errorLabel2) {
-  if (path25 === "" || path25 === ".") return root;
-  const parts = path25.split(".");
-  let value22 = root;
-  for (const part of parts) {
-    if (typeof value22 === "object" && value22 !== null) value22 = value22[part];
-    else throw new WorkflowTemplateError(`Invalid path ${path25} in ${errorLabel2}`, path25);
-  }
-  return value22;
-}
-function stringifyTemplateValue(v, template22, idx, rawExpr) {
-  if (v === null || v === void 0) return "";
-  if (typeof v === "object") {
-    try {
-      return JSON.stringify(v);
-    } catch (err) {
-      throw new WorkflowTemplateError(`${describeBadPlaceholder(template22, idx, rawExpr)} resolved to a value that could not be JSON-stringified (${err.message}).`, rawExpr);
-    }
-  }
-  return String(v);
-}
-function escapeFence(content) {
-  return content.replace(/<\/lua-data/g, "<\\/lua-data");
-}
-function fenceBlock(name, source, content) {
-  return `<lua-data name="${name}" source="${source}" untrusted="true">${escapeFence(content)}</lua-data>`;
-}
-function renderTemplate(template22, ctx, opts) {
-  let idx = 0;
-  return template22.replace(TEMPLATE_PLACEHOLDER, (_match, rawExpr) => {
-    idx += 1;
-    const { scope, rest } = parseTemplatePlaceholder(rawExpr);
-    const label = describeBadPlaceholder(template22, idx, rawExpr);
-    let rendered;
-    let source;
-    switch (scope) {
-      case "initData":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.initData, rest, label), template22, idx, rawExpr);
-        source = "initData";
-        break;
-      case "state":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.state, rest, label), template22, idx, rawExpr);
-        source = "state";
-        break;
-      case "requestContext":
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.requestContext, rest, label), template22, idx, rawExpr);
-        source = "requestContext";
-        break;
-      case "stepResults": {
-        const innerDot = rest.indexOf(".");
-        const stepId = innerDot === -1 ? rest : rest.slice(0, innerDot);
-        const subPath = innerDot === -1 ? "" : rest.slice(innerDot + 1);
-        if (!stepId) throw new WorkflowTemplateError(`${label} must name a step: \${stepResults.<stepId>.<path>}.`, rawExpr);
-        if (!(stepId in ctx.stepResults) || ctx.stepResults[stepId] == null) {
-          throw new WorkflowTemplateError(`${label} references stepResults.${stepId} but step "${stepId}" has no resolvable output (not an ancestor, not run, failed, or produced no output).`, rawExpr);
-        }
-        rendered = stringifyTemplateValue(traverseMappingPath(ctx.stepResults[stepId], subPath, label), template22, idx, rawExpr);
-        source = `step:${stepId}`;
-        break;
-      }
-      default:
-        throw new WorkflowTemplateError(`${label} references unknown namespace "${scope}". Use one of: ${TEMPLATE_NAMESPACES.join(", ")}.`, rawExpr);
-    }
-    return opts.fenced ? fenceBlock(rawExpr, source, rendered) : rendered;
-  });
-}
-function resolveDescriptor(key, m, ctx) {
-  try {
-    if ("value" in m) return {
-      value: m.value
-    };
-    if ("template" in m && typeof m.template === "string") {
-      return {
-        value: renderTemplate(m.template, ctx, {
-          fenced: false
-        })
-      };
-    }
-    if ("knowledge" in m || "rows" in m && m.rows !== void 0) {
-      return {
-        error: "binding_unresolved",
-        key
-      };
-    }
-    if ("requestContextPath" in m) {
-      const label = `requestContext path for key "${key}"`;
-      return {
-        value: traverseMappingPath(ctx.requestContext, m.requestContextPath, label)
-      };
-    }
-    if ("path" in m) {
-      const source = "initData" in m && m.initData ? "initData" : "step";
-      if (source === "initData") {
-        return {
-          value: traverseMappingPath(ctx.initData, m.path, `initData for key "${key}"`)
-        };
-      }
-      const stepRef = m.step;
-      const candidates = Array.isArray(stepRef) ? stepRef : [
-        stepRef
-      ];
-      const stepId = candidates.find((s) => ctx.stepResults[s] !== void 0 && ctx.stepResults[s] !== null);
-      if (stepId === void 0) return {
-        error: "binding_unresolved",
-        key
-      };
-      return {
-        value: traverseMappingPath(ctx.stepResults[stepId], m.path, `step ${candidates.join("|")} for key "${key}"`)
-      };
-    }
-    return {
-      error: "binding_unresolved",
-      key
-    };
-  } catch (err) {
-    if (err instanceof WorkflowTemplateError) return {
-      error: "binding_unresolved",
-      key
-    };
-    throw err;
-  }
-}
-function resolveMapping(cfg, ctx) {
-  const keys = Object.keys(cfg);
-  if (keys.length === 1 && keys[0] === "") {
-    return resolveDescriptor("", cfg[""], ctx);
-  }
-  const result = {};
-  for (const key of keys) {
-    const resolved = resolveDescriptor(key, cfg[key], ctx);
-    if ("error" in resolved) return resolved;
-    result[key] = resolved.value;
-  }
-  return {
-    value: result
-  };
-}
 function continuedFailureValue(error, killReason) {
   const code = typeof error?.code === "string" && error.code || typeof killReason === "string" && killReason || CONTINUED_FAILURE_DEFAULT_CODE;
   const message = typeof error?.message === "string" && error.message ? error.message : code;
@@ -5094,15 +5615,64 @@ function runCounts(counts) {
     pending: n(c.pending) + n(c.ready) + n(c.waiting)
   };
 }
-function runUsage(run) {
+function isPricedStepReceipt(receipt) {
+  return typeof receipt?.multiplier === "number" && Number.isFinite(receipt.multiplier);
+}
+function receiptEngine(engine) {
+  if (engine === "actions") return "seat";
+  if (engine === "credits") return "legacy";
+  return void 0;
+}
+function receiptTier(tier) {
+  return tier === "light" || tier === "standard" || tier === "heavy" ? tier : void 0;
+}
+function stepBillingView(receipt) {
+  const engine = receiptEngine(receipt?.engine);
+  if (!receipt || engine === void 0) return void 0;
+  return pruneUndefined({
+    engine,
+    attempt: typeof receipt.attempt === "number" ? receipt.attempt : void 0,
+    credits: typeof receipt.credits === "number" ? receipt.credits : void 0,
+    actions: typeof receipt.actionsEstimate === "number" ? receipt.actionsEstimate : void 0,
+    model: typeof receipt.model === "string" ? receipt.model : void 0,
+    tier: receiptTier(receipt.tier),
+    multiplier: typeof receipt.multiplier === "number" ? receipt.multiplier : void 0,
+    byok: typeof receipt.byok === "boolean" ? receipt.byok : void 0,
+    calibrated: typeof receipt.calibrated === "boolean" ? receipt.calibrated : void 0
+  });
+}
+function runUsage(run, receipts) {
+  const actions = n(run.budget?.spent?.actionsEstimate);
+  const stamped = run.budget?.engine;
+  const priced = (receipts ?? []).filter(isPricedStepReceipt);
+  const engine = stamped === "seat" || stamped === "legacy" ? stamped : actions > 0 || priced.some((r) => r.engine === "actions") ? "seat" : priced.some((r) => r.engine === "credits") ? "legacy" : void 0;
+  const seat = engine === "seat";
+  const metering = engine ? "priced" : "flat";
   return {
     creditsUsed: run.budget?.spent?.credits ?? 0,
     actionsEstimate: run.budget?.spent?.actionsEstimate ?? 0,
+    ...seat ? {
+      actionsUsed: actions
+    } : {},
+    metering,
+    ...engine ? {
+      engine
+    } : {},
     steps: run.budget?.spent?.steps ?? 0,
     inputTokens: run.usage?.inputTokens ?? 0,
     outputTokens: run.usage?.outputTokens ?? 0
   };
 }
+function runBudgetCap(budget) {
+  const cap = budget?.maxCredits;
+  return typeof cap === "number" && Number.isFinite(cap) && cap > 0 ? cap : void 0;
+}
+function runBudgetRemaining(budget) {
+  const cap = runBudgetCap(budget);
+  if (cap === void 0) return void 0;
+  const spent = budget?.spent;
+  return Math.max(0, cap - n(spent?.credits) - n(spent?.actionsEstimate) - n(budget?.reserved));
+}
 function runCancelView(cancel) {
   if (!cancel) return void 0;
   return {
@@ -6121,7 +6691,7 @@ function needsInheritedWorkspace(graph) {
   }
   return false;
 }
-var __defProp3, __name3, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
+var __defProp3, __name3, WorkflowTemplateError, TEMPLATE_PLACEHOLDER, TEMPLATE_NAMESPACES, MAP_DESCRIPTOR_KEYS, MAP_MEMBER_MALFORMED_CODE, fromInit, fromStep, value, template, fromRequest, rows, fromKnowledge, SideEffectsSchema, JobResourcesSchema, WORKFLOW_ARM_SUBRUN_ID, WORKSPACE_TEMPLATE_EXPR_RE, SLEEP_UNTIL_REPLACEMENT, WORKFLOW_CAPS_DEFAULT, WORKFLOW_STEP_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_AGENT_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_JOB_DEFAULT_TIMEOUT_SECONDS, WORKFLOW_FOREACH_DEFAULT_CONCURRENCY, WORKFLOW_FOREACH_DEFAULT_MAX_ITEMS, WORKFLOW_LOOP_DEFAULT_MAX_ITERATIONS, WORKFLOW_SUSPEND_DEFAULT_TIMEOUT_HOURS, WORKFLOW_SIGNAL_DEFAULT_SOURCES, clone, CONNECTION_ID_HEX_RE, WORKFLOW_JOB_TOOLS, WORKFLOW_JOB_MAX_WORKTREE_ARMS, workspaceOf, mountsWorkspace, isJobTier, jobToolsOf, schemaIsArray, isHitlNode, isSingleStep, singleId, armId, TEMPLATE_STEP_REF, EDITABLE_PATH_RE, PREDICATE_OPS, isPredicateScalar, GRAPH_HASH_PREFIX, WorkflowPlanError, isArmStep, armStepId, armStepKind, joinIdOf, containerIdOf, PATH_PLACEHOLDER, MISSING, stepIdOf, cmp, eq, ne, gt, gte, lt, lte, inSet, notIn, exists, notExists, truthy, falsy, and, or, not, CONTINUED_FAILURE_TAG, CONTINUED_FAILURE_DEFAULT_CODE, CONTINUED_FAILURE_OUTPUT_SCHEMA, CONTINUED_FAILURE_LEAF_PATHS, isHitlNode2, nodeIdOf, GOAL_JUDGE_STEP_ID, NON_LEAF_KINDS, CONDITIONAL_JOIN_ID, branchArmId, canonical, sortKeys, JOIN, entryOfJoin, FORCE_CANCEL_STALE_MS, TERMINAL, IN_FLIGHT, n, STEP_ERROR_DETAIL_KEYS, STEP_ERROR_DETAIL_MAX_BYTES, DETAIL_MAX_DEPTH, DETAIL_MAX_ITEMS, MAX_HOLIDAYS, MAX_WALK_DAYS, HHMM, YMD, MS_PER_MIN, MS_PER_DAY, MON_FRI, supportedTz, fmtCache, WEEKDAYS, JSON_PATCH_OPS, JSON_PATCH_MAX_OPS, JSON_PATCH_MAX_VALUE_BYTES, JSON_PATCH_MAX_TOTAL_BYTES, SEGMENT_RE, APPROVER_SPEC_MAX_USERS, ESCALATION_MAX_HOPS, TemplateBindingSchema, ApproverSpecSchema, FourEyesSchema, EscalationHopSchema, TerminalOutcomeSchema, ApprovalOnTimeoutSchema, APPROVER_SPEC_SHAPES, APPROVER_WRITTEN_MAX, USER_ID_SHAPED_RE, BINDING_ROOTS, WORKFLOW_ENV_OVERLAY_MAX_KEYS, WORKFLOW_ENV_OVERLAY_MAX_VALUE_BYTES, WORKFLOW_ENV_TEMPLATE_SECRET_KEY_RE, isEnvRef, looksLikeEmbeddedJson, ZERO, isRecord2;
 var init_dist2 = __esm({
   "../workflow-graph/dist/index.mjs"() {
     "use strict";
@@ -6134,6 +6704,94 @@ var init_dist2 = __esm({
     init_dist();
     __defProp3 = Object.defineProperty;
     __name3 = /* @__PURE__ */ __name((target, value22) => __defProp3(target, "name", { value: value22, configurable: true }), "__name");
+    WorkflowTemplateError = class extends Error {
+      static {
+        __name(this, "WorkflowTemplateError");
+      }
+      static {
+        __name3(this, "WorkflowTemplateError");
+      }
+      placeholder;
+      constructor(message, placeholder) {
+        super(message), this.placeholder = placeholder;
+        this.name = "WorkflowTemplateError";
+      }
+    };
+    __name(isMapConfigObject, "isMapConfigObject");
+    __name3(isMapConfigObject, "isMapConfigObject");
+    __name(parseMapConfig, "parseMapConfig");
+    __name3(parseMapConfig, "parseMapConfig");
+    __name(mapConfigWire, "mapConfigWire");
+    __name3(mapConfigWire, "mapConfigWire");
+    TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
+    TEMPLATE_NAMESPACES = [
+      "initData",
+      "state",
+      "requestContext",
+      "stepResults"
+    ];
+    __name(describeBadPlaceholder, "describeBadPlaceholder");
+    __name3(describeBadPlaceholder, "describeBadPlaceholder");
+    __name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+    __name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
+    __name(traverseMappingPath, "traverseMappingPath");
+    __name3(traverseMappingPath, "traverseMappingPath");
+    __name(stringifyTemplateValue, "stringifyTemplateValue");
+    __name3(stringifyTemplateValue, "stringifyTemplateValue");
+    __name(escapeFence, "escapeFence");
+    __name3(escapeFence, "escapeFence");
+    __name(fenceBlock, "fenceBlock");
+    __name3(fenceBlock, "fenceBlock");
+    __name(renderTemplate, "renderTemplate");
+    __name3(renderTemplate, "renderTemplate");
+    __name(isMapDescriptor, "isMapDescriptor");
+    __name3(isMapDescriptor, "isMapDescriptor");
+    MAP_DESCRIPTOR_KEYS = [
+      "step",
+      "path",
+      "initData",
+      "value",
+      "template",
+      "requestContextPath",
+      "knowledge"
+    ];
+    MAP_MEMBER_MALFORMED_CODE = "map-member-malformed";
+    __name(malformedMapMembers, "malformedMapMembers");
+    __name3(malformedMapMembers, "malformedMapMembers");
+    __name(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+    __name3(mapMemberMalformedMessage, "mapMemberMalformedMessage");
+    __name(resolveDescriptor, "resolveDescriptor");
+    __name3(resolveDescriptor, "resolveDescriptor");
+    __name(resolveMapping, "resolveMapping");
+    __name3(resolveMapping, "resolveMapping");
+    fromInit = /* @__PURE__ */ __name3((path25) => ({
+      initData: true,
+      path: path25
+    }), "fromInit");
+    fromStep = /* @__PURE__ */ __name3((s, path25 = "") => {
+      const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
+      return {
+        step: Array.isArray(s) ? s.map(idOf) : idOf(s),
+        path: path25
+      };
+    }, "fromStep");
+    value = /* @__PURE__ */ __name3((v) => ({
+      value: v
+    }), "value");
+    template = /* @__PURE__ */ __name3((s) => ({
+      template: s
+    }), "template");
+    fromRequest = /* @__PURE__ */ __name3((path25) => ({
+      requestContextPath: path25
+    }), "fromRequest");
+    rows = /* @__PURE__ */ __name3((s, path25, page) => ({
+      step: typeof s === "string" ? s : s.id,
+      path: path25,
+      rows: page
+    }), "rows");
+    fromKnowledge = /* @__PURE__ */ __name3((k) => ({
+      knowledge: k
+    }), "fromKnowledge");
     SideEffectsSchema = z6.enum(WORKFLOW_SIDE_EFFECTS);
     JobResourcesSchema = z6.enum(WORKFLOW_JOB_RESOURCES);
     WORKFLOW_ARM_SUBRUN_ID = "$arm";
@@ -6377,78 +7035,6 @@ var init_dist2 = __esm({
       op: "not",
       arg
     }), "not");
-    WorkflowTemplateError = class extends Error {
-      static {
-        __name(this, "WorkflowTemplateError");
-      }
-      static {
-        __name3(this, "WorkflowTemplateError");
-      }
-      placeholder;
-      constructor(message, placeholder) {
-        super(message), this.placeholder = placeholder;
-        this.name = "WorkflowTemplateError";
-      }
-    };
-    __name(isMapConfigObject, "isMapConfigObject");
-    __name3(isMapConfigObject, "isMapConfigObject");
-    __name(parseMapConfig, "parseMapConfig");
-    __name3(parseMapConfig, "parseMapConfig");
-    __name(mapConfigWire, "mapConfigWire");
-    __name3(mapConfigWire, "mapConfigWire");
-    TEMPLATE_PLACEHOLDER = /\$\{([^}]*)\}/g;
-    TEMPLATE_NAMESPACES = [
-      "initData",
-      "state",
-      "requestContext",
-      "stepResults"
-    ];
-    __name(describeBadPlaceholder, "describeBadPlaceholder");
-    __name3(describeBadPlaceholder, "describeBadPlaceholder");
-    __name(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-    __name3(parseTemplatePlaceholder, "parseTemplatePlaceholder");
-    __name(traverseMappingPath, "traverseMappingPath");
-    __name3(traverseMappingPath, "traverseMappingPath");
-    __name(stringifyTemplateValue, "stringifyTemplateValue");
-    __name3(stringifyTemplateValue, "stringifyTemplateValue");
-    __name(escapeFence, "escapeFence");
-    __name3(escapeFence, "escapeFence");
-    __name(fenceBlock, "fenceBlock");
-    __name3(fenceBlock, "fenceBlock");
-    __name(renderTemplate, "renderTemplate");
-    __name3(renderTemplate, "renderTemplate");
-    __name(resolveDescriptor, "resolveDescriptor");
-    __name3(resolveDescriptor, "resolveDescriptor");
-    __name(resolveMapping, "resolveMapping");
-    __name3(resolveMapping, "resolveMapping");
-    fromInit = /* @__PURE__ */ __name3((path25) => ({
-      initData: true,
-      path: path25
-    }), "fromInit");
-    fromStep = /* @__PURE__ */ __name3((s, path25 = "") => {
-      const idOf = /* @__PURE__ */ __name3((x) => typeof x === "string" ? x : x.id, "idOf");
-      return {
-        step: Array.isArray(s) ? s.map(idOf) : idOf(s),
-        path: path25
-      };
-    }, "fromStep");
-    value = /* @__PURE__ */ __name3((v) => ({
-      value: v
-    }), "value");
-    template = /* @__PURE__ */ __name3((s) => ({
-      template: s
-    }), "template");
-    fromRequest = /* @__PURE__ */ __name3((path25) => ({
-      requestContextPath: path25
-    }), "fromRequest");
-    rows = /* @__PURE__ */ __name3((s, path25, page) => ({
-      step: typeof s === "string" ? s : s.id,
-      path: path25,
-      rows: page
-    }), "rows");
-    fromKnowledge = /* @__PURE__ */ __name3((k) => ({
-      knowledge: k
-    }), "fromKnowledge");
     CONTINUED_FAILURE_TAG = "continued_failure";
     CONTINUED_FAILURE_DEFAULT_CODE = "step_failed";
     CONTINUED_FAILURE_OUTPUT_SCHEMA = Object.freeze({
@@ -6574,8 +7160,20 @@ var init_dist2 = __esm({
     n = /* @__PURE__ */ __name3((v) => typeof v === "number" && Number.isFinite(v) ? v : 0, "n");
     __name(runCounts, "runCounts");
     __name3(runCounts, "runCounts");
+    __name(isPricedStepReceipt, "isPricedStepReceipt");
+    __name3(isPricedStepReceipt, "isPricedStepReceipt");
+    __name(receiptEngine, "receiptEngine");
+    __name3(receiptEngine, "receiptEngine");
+    __name(receiptTier, "receiptTier");
+    __name3(receiptTier, "receiptTier");
+    __name(stepBillingView, "stepBillingView");
+    __name3(stepBillingView, "stepBillingView");
     __name(runUsage, "runUsage");
     __name3(runUsage, "runUsage");
+    __name(runBudgetCap, "runBudgetCap");
+    __name3(runBudgetCap, "runBudgetCap");
+    __name(runBudgetRemaining, "runBudgetRemaining");
+    __name3(runBudgetRemaining, "runBudgetRemaining");
     __name(runCancelView, "runCancelView");
     __name3(runCancelView, "runCancelView");
     __name(runWorkspaceView, "runWorkspaceView");
@@ -7060,6 +7658,7 @@ var init_workflow = __esm({
     }, "assertPredicate");
     assertRetry = /* @__PURE__ */ __name((r, id) => {
       if (!r) return;
+      if (typeof r.maxAttempts === "number" && r.maxAttempts > WORKFLOW_RETRY_MAX_ATTEMPTS) throw new LuaWorkflowBuildError("cap-exceeded", `"${id}": ${workflowRetryMaxAttemptsMessage(r.maxAttempts)}`);
       if (r.backoff !== void 0 && !WORKFLOW_RETRY_BACKOFFS.includes(r.backoff)) throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.backoff must be ${WORKFLOW_RETRY_BACKOFFS.map((b) => `'${b}'`).join(" | ")}`);
       if (r.maxBackoffSeconds !== void 0) {
         if (r.backoff !== "exponential") throw new LuaWorkflowBuildError("backoff-invalid", `"${id}": retry.maxBackoffSeconds is only meaningful with backoff:'exponential'`);
@@ -7970,6 +8569,10 @@ async function* parseSseStream(body, signal) {
       if (frame) yield frame;
     }
   } finally {
+    try {
+      await reader.cancel();
+    } catch {
+    }
     try {
       reader.releaseLock();
     } catch {
@@ -7999,6 +8602,7 @@ var init_http_client = __esm({
     "use strict";
     init_dist();
     init_auth_error();
+    init_cli_error();
     init_lua_fetch();
     init_request_credential();
     DEFAULT_REQUEST_TIMEOUT_MS = 3e4;
@@ -8062,7 +8666,7 @@ var init_http_client = __esm({
           if (AuthenticationError.isAuthenticationError(error)) {
             throw error;
           }
-          if (error instanceof Error && error.message.startsWith("Access denied (403)")) {
+          if (isAccessDeniedError(error)) {
             throw error;
           }
           if (error instanceof DOMException && error.name === "AbortError") {
@@ -8110,8 +8714,11 @@ var init_http_client = __esm({
         }
         if (response.status === 403) {
           const detail = errorData.message || "You do not have permission to access this resource.";
-          throw new Error(`Access denied (403): ${detail}
-Check that your Lua login has access to this agent or organization.`);
+          throw new CliError("forbidden", `Access denied (403): ${detail}`, {
+            exitCode: CLI_EXIT.FORBIDDEN,
+            statusCode: 403,
+            hint: "Check that your Lua login has access to this agent or organization."
+          });
         }
         return {
           success: false,
@@ -9379,6 +9986,7 @@ var init_base_handler = __esm({
     init_bundle_upload();
     init_semver();
     init_auth_error();
+    init_cli_error();
     DEFAULT_VERSION = SKILL_DEFAULTS.VERSION;
     BaseVersionedHandler = class {
       static {
@@ -9460,7 +10068,7 @@ var init_base_handler = __esm({
             serverItems
           };
         } catch (error) {
-          if (AuthenticationError.isAuthenticationError(error)) throw error;
+          if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
           return {
             serverItems: null,
             fetchError: error instanceof Error ? error.message : String(error)
@@ -9490,13 +10098,24 @@ var init_base_handler = __esm({
           }
           const yamlItems = this.getFromYaml(config);
           const { yamlById, yamlByName, serverByName } = this.buildMaps(serverData.serverItems, yamlItems);
+          const idField = this.yamlConfig.idField;
+          const manifestNames = manifest ? new Set(getPrimitivesByKind(manifest, this.kind).map((p) => p.name)) : /* @__PURE__ */ new Set();
+          for (const stale of this.staleYamlRows(yamlItems, serverData.serverItems, manifestNames)) {
+            const idx = yamlItems.indexOf(stale);
+            if (idx < 0) continue;
+            const { [idField]: goneId, ...rest } = stale;
+            yamlItems[idx] = rest;
+            yamlUpdated = true;
+            const msg = `\u2139\uFE0F  ${this.displayName} "${stale.name}" (${goneId}) no longer exists on the server \u2014 re-registering it`;
+            messages.push(msg);
+            console.log(msg);
+          }
           const orphans = serverData.serverItems.filter((item) => {
             const id = item.id;
             const name = item.name;
             return !yamlById.has(id) && !yamlByName.has(name) && this.isActive(item) && this.shouldConsiderForOrphan(item);
           });
           if (orphans.length > 0) {
-            const idField = this.yamlConfig.idField;
             const stubs = orphans.map((item) => this.cleanItem({
               name: item.name,
               version: this.getActiveVersion(item) || DEFAULT_VERSION,
@@ -9539,6 +10158,7 @@ var init_base_handler = __esm({
             console.log(`\u2705 Server ${this.displayNamePlural} and YAML are fully in sync`);
           }
         } catch (error) {
+          if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
           console.error(`\u274C Error syncing server ${this.displayNamePlural}:`, error);
         }
         return {
@@ -9595,6 +10215,7 @@ var init_base_handler = __esm({
               console.error(`   \u274C Failed to create "${item.name}" - no ID returned`);
             }
           } catch (error) {
+            if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
             console.error(`   \u274C Failed to create "${item.name}": ${error instanceof Error ? error.message : error}`);
           }
         }
@@ -9729,6 +10350,15 @@ var init_base_handler = __esm({
       getItemId(item) {
         return item[this.yamlConfig.idField] || "";
       }
+      /**
+      * LUA-750: the yaml rows whose server id is gone (deleted server-side) and which `applySyncToYaml` should
+      * re-register. Default none — a handler whose `fetchFromServer` lists EVERY live row of its kind for the
+      * agent overrides this (a kind whose list omits inactive rows must not, or it would duplicate them).
+      * `manifestNames` is the set of primitives in local code: only those are worth re-creating.
+      */
+      staleYamlRows(_yamlItems, _serverItems, _manifestNames) {
+        return [];
+      }
       buildMaps(serverItems, yamlItems) {
         const yamlById = /* @__PURE__ */ new Map();
         const yamlByName = /* @__PURE__ */ new Map();
@@ -9818,7 +10448,7 @@ var init_base_handler = __esm({
             serverItems
           };
         } catch (error) {
-          if (AuthenticationError.isAuthenticationError(error)) throw error;
+          if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
           return {
             serverItems: null,
             fetchError: error instanceof Error ? error.message : String(error)
@@ -9887,6 +10517,7 @@ var init_base_handler = __esm({
             console.log(`\u2705 Server ${this.displayNamePlural} and YAML are fully in sync`);
           }
         } catch (error) {
+          if (AuthenticationError.isAuthenticationError(error) || isAccessDeniedError(error)) throw error;
           console.error(`\u274C Error syncing server ${this.displayNamePlural}:`, error);
         }
         return {
@@ -10697,46 +11328,48 @@ async function withErrorHandling(commandFn, commandName, opts) {
       });
       await shutdownAnalytics();
       process.exit(0);
+      return void 0;
+    }
+    if (isHandledCliError(error)) {
+      trackCommand({
+        commandName,
+        success: false,
+        durationMs: Date.now() - startTime,
+        cliVersion: getCliVersion(),
+        error: error.message,
+        properties: {
+          is_auth_error: AuthenticationError.isAuthenticationError(error.original),
+          nested: true
+        }
+      });
+      await showUpdateWarningIfNeeded(versionCheckPromise);
+      await shutdownAnalytics();
+      throw error;
     }
     trackCommand({
       commandName,
       success: false,
       durationMs: Date.now() - startTime,
       cliVersion: getCliVersion(),
-      error: error.message,
+      error: error?.message,
       properties: {
         is_auth_error: AuthenticationError.isAuthenticationError(error)
       }
     });
-    if (AuthenticationError.isAuthenticationError(error)) {
-      console.error(`
-\u274C ${error.message}`);
-      if (!error.suppressDefaultRemediation) {
-        if (error.reason === "no_agent_access") {
-          console.error("\n  Your API key is valid, but it does not have access to the agentId\n  configured in lua.skill.yaml. This usually means:\n\n    \u2022 The agentId belongs to a different account or organization\n    \u2022 The agent was deleted, transferred, or you lost access to it\n    \u2022 You're using a lua.skill.yaml copied from another project\n\n  Check the configured agent and switch if needed:\n\n    \u279C  lua agents          (list agents you have access to)\n    \u279C  lua init            (re-select the agent for this project)\n");
-        } else {
-          console.error("\n  Re-authenticate or check your API key:\n\n    \u279C  lua auth configure\n    \u279C  https://admin.heylua.ai\n");
-        }
-      } else {
-        console.error("");
-      }
-      await showUpdateWarningIfNeeded(versionCheckPromise);
-      await shutdownAnalytics();
-      process.exit(1);
-    }
-    console.error(`\u274C Error during ${commandName}:`, error.message);
-    if (opts?.onError && !hintsDisabled()) {
+    let extraHint;
+    if (opts?.onError && !hintsDisabled() && !AuthenticationError.isAuthenticationError(error)) {
       try {
-        const hint = opts.onError(error);
-        if (hint) {
-          console.error(`\u{1F4A1} ${hint}`);
-        }
+        extraHint = opts.onError(error) ?? void 0;
       } catch {
       }
     }
+    const reported = reportCliError(error, {
+      extraHint
+    });
+    process.exitCode = reported.exitCode;
     await showUpdateWarningIfNeeded(versionCheckPromise);
     await shutdownAnalytics();
-    throw new Error(`Error during ${commandName}: ${error.message}`);
+    throw new HandledCliError(reported.message, reported.exitCode, error);
   }
 }
 function clearPromptLines(count = 1) {
@@ -10755,6 +11388,7 @@ var init_cli = __esm({
   "src/utils/cli.ts"() {
     "use strict";
     init_auth_error();
+    init_cli_error();
     init_version_check();
     init_package_root();
     init_analytics();
@@ -10856,6 +11490,15 @@ async function checkApiKey(apiKey) {
   const authApi = new AuthApi(BASE_URLS.API);
   const result = await authApi.checkApiKey(apiKey);
   if (!result.success) {
+    const status = result.error?.statusCode ?? 0;
+    if (status === 0 || status >= 500) {
+      const detail = result.error?.message ?? "no response";
+      throw new CliError("unavailable", `Could not verify the API key \u2014 the Lua API at ${BASE_URLS.API} is unavailable (${detail})`, {
+        exitCode: CLI_EXIT.UNAVAILABLE,
+        statusCode: status,
+        hint: UNAVAILABLE_HINT
+      });
+    }
     throw new AuthenticationError("Invalid API key");
   }
   return result.data;
@@ -10886,6 +11529,7 @@ var init_auth = __esm({
     init_auth_api_service();
     init_constants();
     init_auth_error();
+    init_cli_error();
     __name(getToken, "getToken");
     __name(saveApiKey, "saveApiKey");
     __name(checkApiKey, "checkApiKey");
@@ -10898,31 +11542,27 @@ var init_auth = __esm({
 async function requireAuth() {
   return resolveRequestCredential();
 }
-async function requireAuthOrExit(showProgress = true) {
-  const apiKey = await resolveRequestCredential();
-  if (showProgress) {
-    writeProgress("\u2705 Authenticated");
-  }
-  return apiKey;
+async function requireAuthOrExit(_showProgress = true) {
+  return resolveRequestCredential();
 }
 async function initializeCommand(options = {}) {
   const { showProgress = true, validateAuth = false } = options;
   const config = readYamlConfig();
   if (!config) {
-    throw new Error("No lua.skill.yaml found. Please run this command from a skill directory.");
+    throw CliError.usage("No lua.skill.yaml found \u2014 run this command from a Lua project directory.", "lua init creates one");
   }
   if (!config.agent?.agentId) {
-    throw new Error("Missing agentId in skill configuration. Please run 'lua init' first.");
+    throw CliError.usage("Missing agentId in lua.skill.yaml.", "Run 'lua init' to select the agent for this project");
   }
   if (!config.agent?.orgId) {
-    throw new Error("Missing orgId in skill configuration. Please run 'lua init' first.");
+    throw CliError.usage("Missing orgId in lua.skill.yaml.", "Run 'lua init' to select the agent for this project");
   }
   const apiKey = await resolveRequestCredential();
   let userData = void 0;
   if (validateAuth) {
     userData = await checkApiKey(await bearerFor(apiKey));
   }
-  if (showProgress) {
+  if (showProgress && validateAuth) {
     writeProgress("\u2705 Authenticated");
   }
   return {
@@ -10940,6 +11580,7 @@ var init_command_utils = __esm({
     init_request_credential();
     init_files();
     init_cli();
+    init_cli_error();
     __name(requireAuth, "requireAuth");
     __name(requireAuthOrExit, "requireAuthOrExit");
     __name(initializeCommand, "initializeCommand");
@@ -24078,7 +24719,10 @@ var init_workflow_api_service = __esm({
       async getRunReplayBundle(runId) {
         return this.httpGet(`${this.runs}/${runId}/journal?format=replay`, await this.auth());
       }
-      /** R11 — cancel (`mode:'request'` default; `'force'` after `forceAvailableAt`, 409 `FORCE_NOT_YET_AVAILABLE` before). */
+      /**
+      * R11 — cancel (`mode:'request'` default). A `'force'` before `forceAvailableAt` is the 200 verdict
+      * `{ transitioned:false, nextAction:'cancel_again', forceAvailableAt }` (PRO-979) — never a 409 (LUA-748).
+      */
       async cancelRun(runId, data = {}) {
         return this.httpPost(`${this.runs}/${runId}/cancel`, data, await this.auth());
       }
@@ -24157,6 +24801,14 @@ var init_workflow_api_service = __esm({
       async closeGoal(goalId, data = {}) {
         return this.httpPost(`${this.goals}/${encodeURIComponent(goalId)}/close`, data, await this.auth());
       }
+      /** LUA-749 R63 — edit (objective / judge / cadence / caps / note); a `budget` / `max_runs` park re-arms when the cap clears (`rearmed:true`). */
+      async updateGoal(goalId, data) {
+        return this.httpPatch(`${this.goals}/${encodeURIComponent(goalId)}`, data, await this.auth());
+      }
+      /** LUA-749 R64 — raise `maxTotalCredits` / `maxRuns` (increases only; 400 `GOAL_RAISE_BELOW_SPENT{field, value, spent}`). */
+      async raiseGoal(goalId, data) {
+        return this.httpPost(`${this.goals}/${encodeURIComponent(goalId)}/raise`, data, await this.auth());
+      }
       // ─── Schedules (R4-MF-2 list/get + R28 delete — `/workflows/:agentId/schedules`; LUA-627 stanza) ───
       /** Schedule tree (09 §9.5 — the write-only R27/R56/R28 family plus the R4-MF-2 read rows). */
       get schedules() {
@@ -24170,7 +24822,7 @@ var init_workflow_api_service = __esm({
       async getSchedule(jobId) {
         return this.httpGet(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
       }
-      /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a goal-owned job BEFORE this call (`goal_schedule`). */
+      /** R28 — delete a schedule Job (404 `SCHEDULE_NOT_FOUND`). The CLI refuses a LIVE goal's job BEFORE this call (`goal_schedule`); an ended goal's lingering Job is retired here (LUA-760). */
       async deleteSchedule(jobId) {
         return this.httpDelete(`${this.schedules}/${encodeURIComponent(jobId)}`, await this.auth());
       }
@@ -25707,6 +26359,7 @@ __name(configureCommand, "configureCommand");
 // src/commands/init.ts
 import inquirer4 from "inquirer";
 init_command_utils();
+init_cli_error();
 init_cli();
 import { writeFileSync as writeFileSync7, existsSync as existsSync8 } from "fs";
 import { join as join8 } from "path";
@@ -27942,10 +28595,7 @@ function requireLegacyMutationCredential(credential, mutation) {
   }
   const action = mutation === "create" ? "create a new agent" : "duplicate an agent";
   const message = `Scoped CLI credentials cannot ${action}. Use your renewable first-party session in the Lua dashboard, then rerun \`lua init --agent-id <id>\`.`;
-  writeError(`
-\u274C ${message}`);
-  writeInfo("   Dashboard: https://admin.heylua.ai\n");
-  throw new Error(message);
+  throw CliError.forbidden(message, "Dashboard: https://admin.heylua.ai");
 }
 __name(requireLegacyMutationCredential, "requireLegacyMutationCredential");
 function toInitOrganizations(organizations) {
@@ -28274,9 +28924,8 @@ async function initCommand(options = {}) {
   return withErrorHandling(async () => {
     const mode = determineInitMode(options);
     if (mode.type === "error") {
-      console.error(`\u274C ${mode.message}`);
       showInitUsage();
-      throw new Error(`${mode.message}`);
+      throw CliError.usage(mode.message);
     }
     const isNonInteractive = mode.type !== "interactive";
     const apiKey = await requireAuthOrExit(false);
@@ -28291,10 +28940,7 @@ async function initCommand(options = {}) {
       const existingAgentId = existingYaml?.agent?.agentId;
       if (existingAgentId) {
         if (isNonInteractive && !options.force) {
-          writeError("\n\u26A0\uFE0F  Project already initialized with an agent");
-          writeInfo(`   Current Agent ID: ${existingAgentId}`);
-          writeInfo("\n\u{1F4A1} Use --force to override the existing configuration\n");
-          throw new Error("Operation failed");
+          throw CliError.usage(`Project already initialized with agent ${existingAgentId}`, "Pass --force to override the existing configuration");
         }
         if (isNonInteractive && options.force) {
           writeInfo("\n\u{1F504} Overriding existing project configuration...\n");
@@ -31809,32 +32455,48 @@ function validateJsonSchema(schema, value3, at = "") {
   return issues;
 }
 __name(validateJsonSchema, "validateJsonSchema");
-function collectLeafPaths(value3, prefix = "") {
-  if (Array.isArray(value3)) {
-    if (value3.length === 0) return [
-      prefix
-    ];
-    return value3.flatMap((v, i) => collectLeafPaths(v, `${prefix}[${i}]`));
-  }
-  if (value3 && typeof value3 === "object") {
-    const entries = Object.entries(value3);
-    if (entries.length === 0) return [
-      prefix
-    ];
-    return entries.flatMap(([k, v]) => collectLeafPaths(v, prefix ? `${prefix}.${k}` : k));
-  }
-  return [
-    prefix
-  ];
-}
-__name(collectLeafPaths, "collectLeafPaths");
-function matchesEditablePath2(leafPath, editablePaths) {
-  return editablePaths.some((pattern) => {
-    const re = new RegExp("^" + pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\[\\\*\\\]/g, "\\[\\d+\\]") + "(\\.|\\[|$)");
-    return re.test(leafPath);
-  });
+var AGENT_REPLY_ENVELOPE_KEYS = /* @__PURE__ */ new Set([
+  "text",
+  "object"
+]);
+function isAgentReplyEnvelope(reply) {
+  if (typeof reply !== "object" || reply === null || Array.isArray(reply)) return false;
+  const keys = Object.keys(reply);
+  if (keys.length === 0 || !keys.every((k) => AGENT_REPLY_ENVELOPE_KEYS.has(k))) return false;
+  const text = reply.text;
+  return text === void 0 || typeof text === "string";
+}
+__name(isAgentReplyEnvelope, "isAgentReplyEnvelope");
+function coerceAgentStepOutput(schema, reply) {
+  const envelope = typeof reply === "string" ? {
+    text: reply
+  } : reply;
+  if (!isAgentReplyEnvelope(envelope)) return {
+    ok: true,
+    output: reply
+  };
+  const { text, object } = envelope;
+  if (object !== void 0) return {
+    ok: true,
+    output: object
+  };
+  if (!schema) return {
+    ok: true,
+    output: {
+      text
+    }
+  };
+  const extracted = extractSingleJsonValue(text ?? "");
+  if ("reason" in extracted) return {
+    ok: false,
+    reason: extracted.reason
+  };
+  return {
+    ok: true,
+    output: extracted.value
+  };
 }
-__name(matchesEditablePath2, "matchesEditablePath");
+__name(coerceAgentStepOutput, "coerceAgentStepOutput");
 var armId2 = /* @__PURE__ */ __name((arm) => arm.type === "step" ? arm.step.id : arm.id, "armId");
 var baseIdOf = /* @__PURE__ */ __name((id) => id.replace(/(\[\d+\]|#\d+)$/, ""), "baseIdOf");
 var outputSchemaOf = /* @__PURE__ */ __name((entry) => {
@@ -31966,10 +32628,6 @@ async function runWorkflowLocallyInner(rawOpts) {
       if (!entry.editable && editable.length === 0) {
         throw new WorkflowLocalUsageError("approval-not-editable", `--approve ${id}: the approval is not editable`, id);
       }
-      const bad = collectLeafPaths(answer.payload).filter((p) => !matchesEditablePath2(p, editable));
-      if (bad.length) {
-        throw new WorkflowLocalUsageError("edit-path-not-allowed", `--approve ${id}: path "${bad[0]}" is outside editablePaths [${editable.join(", ")}]`, id);
-      }
       if (entry.editedPayloadSchema) {
         const issues = validateJsonSchema(entry.editedPayloadSchema, answer.payload);
         if (issues.length) {
@@ -32300,6 +32958,63 @@ async function runWorkflowLocallyInner(rawOpts) {
     if (!issues.length) return void 0;
     return new StepFailure("input_schema_invalid", `input does not match inputSchema of "${single.step.id}" \u2014 the previous node does not emit what the step declares: ${issues.join("; ")}`);
   }, "stepInputIssue");
+  const agentReply = /* @__PURE__ */ __name(async (row2, single, input) => {
+    const id = row2.stepId;
+    const fixture = opts.fixturesDir ? readFixture(id, row2.attempt) : void 0;
+    if (opts.fixturesDir) return fixture;
+    const prompt = renderPrompt(single);
+    if (opts.agents === "live") {
+      if (!opts.agentInvoke) throw new StepFailure("AGENTS_LIVE_UNAVAILABLE", "--agents live needs a dev API session");
+      const t0 = Date.now();
+      const out = await withWall(id, single, () => opts.agentInvoke(single, prompt, input));
+      record(id, row2.attempt, {
+        prompt,
+        input
+      }, out, Date.now() - t0);
+      return out;
+    }
+    if (single.tier === "job" && jobWallS !== void 0) {
+      const segments = Math.max(1, Math.ceil(jobWallS / WORKFLOW_LOCAL_JOB_SEGMENT_MAX_S));
+      let sessionRef;
+      let elapsedS = 0;
+      for (let s = 1; s <= segments; s++) {
+        const wallS = Math.min(WORKFLOW_LOCAL_JOB_SEGMENT_MAX_S, jobWallS - elapsedS);
+        elapsedS += wallS;
+        clock += wallS * 1e3;
+        const requeued = s < segments;
+        const nextSession = `session-${id}-s${s}`;
+        emit2("step.checkpointed", id, {
+          segment: s,
+          segmentsMax: segments,
+          headSha: `local${s}`,
+          elapsedSeconds: elapsedS,
+          remainingSeconds: Math.max(0, jobWallS - elapsedS),
+          requeued,
+          ...requeued ? {
+            nextSegment: s + 1
+          } : {},
+          ...sessionRef ? {
+            resumedFrom: sessionRef
+          } : {},
+          sessionRef: nextSession,
+          reason: requeued ? "segment_boundary" : "interval"
+        });
+        say(`[${stamp()}] ${id} \xB7 checkpointed \xB7 segment ${s}/${segments}${requeued ? ` \u2192 re-queued (resume ${nextSession})` : ""}`);
+        sessionRef = nextSession;
+      }
+      return {
+        text: `[fake:${single.id}] ${segments} segment(s) over ${jobWallS} s \u2014 ${prompt.slice(0, 40)}`,
+        ...fakeObject(single)
+      };
+    }
+    return {
+      text: `[fake:${single.id}] ${prompt.slice(0, 80)}`,
+      ...fakeObject(single)
+    };
+  }, "agentReply");
+  const fakeObject = /* @__PURE__ */ __name((single) => single.outputSchema ? {
+    object: stubFromSchema(single.outputSchema)
+  } : {}, "fakeObject");
   const executeSingle = /* @__PURE__ */ __name(async (row2, single, input) => {
     const id = row2.stepId;
     const drift = stepInputIssue(single, input);
@@ -32344,57 +33059,12 @@ async function runWorkflowLocallyInner(rawOpts) {
         }
       }
       case "agent": {
-        const fixture = opts.fixturesDir ? readFixture(id, row2.attempt) : void 0;
-        if (opts.fixturesDir) return fixture;
-        const prompt = renderPrompt(single);
-        if (opts.agents === "live") {
-          if (!opts.agentInvoke) throw new StepFailure("AGENTS_LIVE_UNAVAILABLE", "--agents live needs a dev API session");
-          const t0 = Date.now();
-          const out = await withWall(id, single, () => opts.agentInvoke(single, prompt, input));
-          record(id, row2.attempt, {
-            prompt,
-            input
-          }, out, Date.now() - t0);
-          return out;
-        }
-        if (single.tier === "job" && jobWallS !== void 0) {
-          const segments = Math.max(1, Math.ceil(jobWallS / WORKFLOW_LOCAL_JOB_SEGMENT_MAX_S));
-          let sessionRef;
-          let elapsedS = 0;
-          for (let s = 1; s <= segments; s++) {
-            const wallS = Math.min(WORKFLOW_LOCAL_JOB_SEGMENT_MAX_S, jobWallS - elapsedS);
-            elapsedS += wallS;
-            clock += wallS * 1e3;
-            const requeued = s < segments;
-            const nextSession = `session-${id}-s${s}`;
-            emit2("step.checkpointed", id, {
-              segment: s,
-              segmentsMax: segments,
-              headSha: `local${s}`,
-              elapsedSeconds: elapsedS,
-              remainingSeconds: Math.max(0, jobWallS - elapsedS),
-              requeued,
-              ...requeued ? {
-                nextSegment: s + 1
-              } : {},
-              ...sessionRef ? {
-                resumedFrom: sessionRef
-              } : {},
-              sessionRef: nextSession,
-              reason: requeued ? "segment_boundary" : "interval"
-            });
-            say(`[${stamp()}] ${id} \xB7 checkpointed \xB7 segment ${s}/${segments}${requeued ? ` \u2192 re-queued (resume ${nextSession})` : ""}`);
-            sessionRef = nextSession;
-          }
-          return {
-            text: `[fake:${single.id}] ${segments} segment(s) over ${jobWallS} s \u2014 ${prompt.slice(0, 40)}`,
-            object: stubFromSchema(single.outputSchema)
-          };
+        const reply = await agentReply(row2, single, input);
+        const coerced = coerceAgentStepOutput(single.outputSchema, reply);
+        if (!coerced.ok) {
+          throw new StepFailure("OUTPUT_SCHEMA_INVALID", `agent reply is not the declared outputSchema object \u2014 ${coerced.reason}`);
         }
-        return {
-          text: `[fake:${single.id}] ${prompt.slice(0, 80)}`,
-          object: stubFromSchema(single.outputSchema)
-        };
+        return coerced.output;
       }
       case "tool": {
         if (opts.fixturesDir) return readFixture(id, row2.attempt);
@@ -32649,33 +33319,35 @@ async function runWorkflowLocallyInner(rawOpts) {
       if (armRow && !taken.includes(a)) skipRow(armRow, "branch_not_taken");
     }
   }, "runBranch");
+  const aliasJoin = /* @__PURE__ */ __name((containerId, containerRow, output2) => {
+    stepResults[containerId] = output2;
+    if (containerRow?.node.kind === "foreach") {
+      stepResults[armId2(containerRow.node.entry.step)] = output2;
+    }
+  }, "aliasJoin");
   const runJoin = /* @__PURE__ */ __name((row2) => {
     const container = row2.node.container ?? row2.stepId.replace(/\.join$/, "");
     const containerRow = rows3.get(container);
     const children = row2.dependsOn.filter((d) => d !== container);
     const completed = children.filter((c) => rows3.get(c)?.status === "completed");
+    let output2;
     if (containerRow?.node.kind === "branch") {
-      const output2 = completed.length === 1 ? stepResults[completed[0]] : Object.fromEntries(completed.map((c) => [
+      output2 = completed.length === 1 ? stepResults[completed[0]] : Object.fromEntries(completed.map((c) => [
         c,
         stepResults[c]
       ]));
-      terminalize(row2, "completed", {
-        output: output2
-      });
-      return;
-    }
-    if (containerRow?.node.kind === "foreach") {
-      terminalize(row2, "completed", {
-        output: children.map((c) => stepResults[c])
-      });
-      return;
-    }
-    terminalize(row2, "completed", {
-      output: Object.fromEntries(completed.map((c) => [
+    } else if (containerRow?.node.kind === "foreach") {
+      output2 = children.map((c) => stepResults[c]);
+    } else {
+      output2 = Object.fromEntries(completed.map((c) => [
         c,
         stepResults[c]
-      ]))
+      ]));
+    }
+    terminalize(row2, "completed", {
+      output: output2
     });
+    aliasJoin(container, containerRow, output2);
   }, "runJoin");
   const runForeach = /* @__PURE__ */ __name(async (row2, entry) => {
     const items = inputFor(row2);
@@ -32818,19 +33490,28 @@ async function runWorkflowLocallyInner(rawOpts) {
       say(`[${stamp()}] ${row2.stepId} \xB7 approval \xB7 "${entry.title ?? row2.stepId}" \u2014 awaiting decision`);
       answer = await opts.prompt("approval", row2.stepId, entry);
     }
+    const decidedBy = {
+      id: opts.userId ?? "local",
+      kind: "user"
+    };
     if (answer.decision === "deny") {
-      const output2 = {
+      const resumeData2 = {
         approved: false,
-        reason: answer.reason
+        ...answer.reason ? {
+          note: answer.reason
+        } : {},
+        editRevision: 0,
+        decidedBy
       };
-      if ((entry.onDeny ?? "fail") === "continue") {
+      const output2 = workflowApprovalOutput(resumeData2);
+      if ((entry.onDeny ?? "continue") !== "fail") {
         terminalize(row2, "completed", {
           output: output2
         });
         return;
       }
       row2.error = {
-        code: "APPROVAL_DENIED",
+        code: "approval_denied",
         message: answer.reason ?? "denied"
       };
       terminalize(row2, "failed", {
@@ -32842,13 +33523,27 @@ async function runWorkflowLocallyInner(rawOpts) {
       };
       return;
     }
-    const payload = answer.payload !== void 0 ? answer.payload : inputFor(row2);
-    terminalize(row2, "completed", {
-      output: {
-        approved: true,
-        payload,
-        edited: answer.payload !== void 0
+    const edited = answer.payload !== void 0;
+    if (edited) {
+      const shown = inputFor(row2);
+      const editable = entry.editablePaths ?? [];
+      if (editable.length) {
+        const bad = changedPointers(shown, answer.payload).filter((p) => !matchesEditablePath(p, editable));
+        if (bad.length) {
+          throw new WorkflowLocalUsageError("edit-path-not-allowed", `--approve ${row2.stepId}: path "${pointerToDotPath(bad[0])}" changed outside editablePaths [${editable.join(", ")}] (the payload the approval showed: ${JSON.stringify(shown)})`, row2.stepId);
+        }
       }
+    }
+    const resumeData = {
+      approved: true,
+      ...edited ? {
+        editedPayload: answer.payload
+      } : {},
+      editRevision: edited ? 1 : 0,
+      decidedBy
+    };
+    terminalize(row2, "completed", {
+      output: workflowApprovalOutput(resumeData)
     });
   }, "runApproval");
   const runSignal = /* @__PURE__ */ __name(async (row2, entry) => {
@@ -33323,7 +34018,16 @@ function createSandbox(options) {
     },
     // Legacy `env('FOO')` getter — kept for backwards compatibility with skills
     // that use it instead of `process.env.FOO`. Both work.
-    env: /* @__PURE__ */ __name((key) => envVars[key], "env"),
+    // LUA-751: `env.template(KEY)` too — a graph-form workflow file calls it at MODULE scope (`schedule.timezone:
+    // env.template('FINANCE_TZ')`, the shipped `vendor-invoices`), `env` is not one of the builder names esbuild
+    // injects (`WORKFLOW_SHIM_NAMES`), so the artifact resolves it against THIS global when `lua workflows run`
+    // loads it — and threw `env.template is not a function`. The placeholder is the SDK's (`types/skill.ts`) and the
+    // compiler's tier-1 stub's (`graph-serializer.ts`); the local `--env` overlay substitutes it on the graph.
+    env: Object.assign((key) => envVars[key], {
+      template: /* @__PURE__ */ __name((key) => ({
+        __envRef: key
+      }), "template")
+    }),
     BasketStatus,
     OrderStatus,
     AI: {
@@ -33850,9 +34554,23 @@ var WorkflowHandler = class extends BaseVersionedHandler {
     });
     return {
       success: response.success,
-      error: response.error?.message
+      error: response.error?.message,
+      statusCode: response.error?.statusCode,
+      code: response.error?.code ?? response.error?.error
     };
   }
+  /**
+  * LUA-750: R1 (`getWorkflows`) lists EVERY non-deleted workflow of the agent, active or not, so a yaml
+  * `workflowId` absent from it is a definition `lua workflows delete` soft-deleted. Only rows in local code (the
+  * manifest) are re-registered; a server-only stub with a dead id is left for the user.
+  */
+  staleYamlRows(yamlItems, serverItems, manifestNames) {
+    const serverIds = new Set(serverItems.map((s) => s?.id));
+    return yamlItems.filter((row2) => {
+      const id = this.getItemId(row2);
+      return !!id && !serverIds.has(id) && manifestNames.has(row2.name);
+    });
+  }
   async publishVersion(apiKey, agentId, entityId, version) {
     const api = this.getApi(apiKey, agentId);
     const response = await api.publishWorkflowVersion(entityId, version);
@@ -34022,9 +34740,10 @@ var syncableHandlers = Object.values(primitiveHandlers);
 
 // src/commands/compile.ts
 init_analytics();
+init_cli_error();
 async function compileCommand(options) {
   return withErrorHandling(async () => {
-    const debugMode = options?.debug || process.env.LUA_DEBUG === "true";
+    const debugMode = options?.debug || debugEnabled();
     const verboseMode = options?.verbose || debugMode;
     const doSync = options?.sync === true;
     const doServerSync = options?.serverSync !== false;
@@ -34095,7 +34814,7 @@ async function compileCommand(options) {
           when: "error"
         });
       }
-      throw new Error("Compilation failed \u2014 see errors above.");
+      throw new CliError("compile_failed", "Compilation failed \u2014 see errors above.");
     }
     ensureGitignored(rootDir, "dist-v2/", "dist/");
     if (result.warnings.length > 0) {
@@ -34263,6 +34982,7 @@ function suggestClosest(input, candidates) {
 __name(suggestClosest, "suggestClosest");
 
 // src/utils/aliases.ts
+init_cli_error();
 function lowerKeys(aliases) {
   const out = {};
   for (const k of Object.keys(aliases)) {
@@ -34687,6 +35407,8 @@ var ALIAS_MAP = {
       "list",
       "get",
       "create",
+      "edit",
+      "raise",
       "pause",
       "resume",
       "close"
@@ -34699,6 +35421,12 @@ var ALIAS_MAP = {
       new: "create",
       add: "create",
       set: "create",
+      // LUA-749: `edit` (R63) / `raise` (R64)
+      update: "edit",
+      patch: "edit",
+      change: "edit",
+      bump: "raise",
+      increase: "raise",
       hold: "pause",
       stop: "pause",
       unpause: "resume",
@@ -35068,11 +35796,9 @@ function validateOrSuggest(group, input, opts) {
   }
   const suggestion = suggestClosest(normalized ?? input, candidates);
   if (suggestion) {
-    throw new Error(`lua: "${input}" is not a valid ${group} value. Did you mean "${suggestion}"?
-Valid values: ${candidates.join(", ")}`);
+    throw CliError.usage(`lua: "${input}" is not a valid ${group} value. Did you mean "${suggestion}"?`, `Valid values: ${candidates.join(", ")}`);
   }
-  throw new Error(`lua: "${input}" is not a valid ${group} value.
-Valid values: ${candidates.join(", ")}`);
+  throw CliError.usage(`lua: "${input}" is not a valid ${group} value.`, `Valid values: ${candidates.join(", ")}`);
 }
 __name(validateOrSuggest, "validateOrSuggest");
 
@@ -35080,6 +35806,27 @@ __name(validateOrSuggest, "validateOrSuggest");
 import fs17 from "fs";
 import path23 from "path";
 init_cli();
+
+// src/utils/stdout-redirect.ts
+async function withStdoutToStderr(active, fn) {
+  if (!active) return fn();
+  const originalWrite = process.stdout.write;
+  const originalLog = console.log;
+  const originalInfo = console.info;
+  process.stdout.write = (chunk, ...rest) => process.stderr.write(chunk, ...rest);
+  console.log = (...args2) => console.error(...args2);
+  console.info = (...args2) => console.error(...args2);
+  try {
+    return await fn();
+  } finally {
+    process.stdout.write = originalWrite;
+    console.log = originalLog;
+    console.info = originalInfo;
+  }
+}
+__name(withStdoutToStderr, "withStdoutToStderr");
+
+// src/commands/workflow-local-run.ts
 init_command_utils();
 init_artifact_loader();
 init_types();
@@ -35094,6 +35841,7 @@ __name(runIdOf, "runIdOf");
 init_dist2();
 
 // src/utils/workflow-script-local.ts
+init_dist();
 function fakeCompletionFor(intent) {
   const env = intent.argsEnvelope ?? {};
   switch (intent.kind) {
@@ -35115,10 +35863,14 @@ function fakeCompletionFor(intent) {
     case "approval":
       return {
         status: "completed",
-        output: {
+        output: workflowApprovalOutput({
           approved: true,
-          decision: "approve"
-        }
+          editRevision: 0,
+          decidedBy: {
+            id: "local",
+            kind: "user"
+          }
+        })
       };
     case "waitForSignal":
     case "signal":
@@ -35269,8 +36021,426 @@ async function runScriptWorkflowLocally(opts, runner) {
 __name(runScriptWorkflowLocally, "runScriptWorkflowLocally");
 
 // src/utils/workflow-script-replay.ts
+init_dist4();
 import { createRequire as createRequire2 } from "module";
 import vm5 from "vm";
+import { createHash as createHash7, randomUUID as randomUUID4 } from "crypto";
+
+// ../sandbox-runtime/dist/workflow-script-wrapper.mjs
+var __defProp7 = Object.defineProperty;
+var __name7 = /* @__PURE__ */ __name((target, value3) => __defProp7(target, "name", { value: value3, configurable: true }), "__name");
+var WORKFLOW_SCRIPT_RUNTIME_KEY = "__luaWorkflowScriptRuntime";
+var WORKFLOW_SCRIPT_PROTOCOL_VERSION = 1;
+var WORKFLOW_SCRIPT_DEFAULT_CAPS = {
+  maxOutstanding: 64,
+  maxEffects: 1e3,
+  maxForeachItems: 4096,
+  scriptWallMs: 3e4,
+  argsMaxBytes: 32 * 1024,
+  stepOutputMaxBytes: 256 * 1024,
+  stepsPerTick: 64,
+  logCap: 1e3,
+  phaseCap: 64,
+  envCap: 4096
+};
+var WORKFLOW_SCRIPT_REPLAY_SOURCE = String.raw`
+(function __luaWorkflowScriptReplay(__rt, __input, __bodyFactory) {
+  'use strict';
+  var setImmediateReal = __rt.setImmediate, nowReal = __rt.now, randomReal = __rt.random, uuidReal = __rt.uuid, sha256Hex = __rt.sha256Hex;
+  var caps = __input.caps || {};
+  var MAX_OUTSTANDING = caps.maxOutstanding || 64;
+  var MAX_EFFECTS = caps.maxEffects || 1000;
+  var MAX_FOREACH = caps.maxForeachItems || 4096;
+  var ARGS_MAX = caps.argsMaxBytes || 32768;
+  var STEP_OUT_MAX = caps.stepOutputMaxBytes || 262144;
+  var STEPS_PER_TICK = caps.stepsPerTick || 64;
+  var LOG_CAP = caps.logCap || 1000, PHASE_CAP = caps.phaseCap || 64, ENV_CAP = caps.envCap || 4096;
+  var INLINE_KINDS = { memo: 1, env: 1, log: 1, phase: 1, budget: 1 };
+  var pendingCount = typeof __input.pendingCount === 'number' ? __input.pendingCount : 0;
+
+  // --- canonicalJson + callHash (04 §4.3.4) — byte-identical to lua-core's reference ---
+  function canonicalJson(v) {
+    if (v === null || typeof v === 'number' || typeof v === 'boolean' || typeof v === 'string') return JSON.stringify(v);
+    if (Array.isArray(v)) { var parts = []; for (var i = 0; i < v.length; i++) parts.push(v[i] === undefined ? 'null' : canonicalJson(v[i])); return '[' + parts.join(',') + ']'; }
+    if (typeof v === 'object') {
+      var keys = Object.keys(v).filter(function (k) { return v[k] !== undefined; }).sort();
+      return '{' + keys.map(function (k) { return JSON.stringify(k) + ':' + canonicalJson(v[k]); }).join(',') + '}';
+    }
+    return 'null';
+  }
+  function callHash(kind, argsForHash) { return 'sha256-cj1:' + sha256Hex(kind + '\n' + canonicalJson(argsForHash)); }
+  function byteSize(v) { try { return JSON.stringify(v === undefined ? null : v).length; } catch (e) { return Infinity; } }
+  function typedError(code, message, extra) { var e = new Error(message || code); e.code = code; if (extra) Object.assign(e, extra); return e; }
+  function errShape(e) {
+    if (e && typeof e === 'object') return { code: String(e.code || 'SCRIPT_THREW'), message: String(e.message || e).slice(0, 1024) };
+    return { code: 'SCRIPT_THREW', message: String(e).slice(0, 1024) };
+  }
+
+  // --- state (04 §4.3.5) ---
+  var journalBySeq = {};
+  var journal = Array.isArray(__input.journal) ? __input.journal : [];
+  for (var j = 0; j < journal.length; j++) journalBySeq[journal[j].seq] = journal[j];
+  var nextSeq = 0, cancelling = false, divergence = null, bailed = null;
+  var issuedCount = 0, intents = [], pending = {};
+  var stepCount = 0, logCount = 0, phaseCount = 0, envCount = 0, currentPhase = undefined;
+  var narration = [];
+  var inClosure = false;
+
+  function drain() { return new Promise(function (r) { setImmediateReal(r); }); }
+  function never() { return new Promise(function () {}); }
+  function deferred() { var d = {}; d.promise = new Promise(function (res, rej) { d.resolve = res; d.reject = rej; }); d.promise.catch(function () {}); return d; }
+  function abort(d) { if (!divergence) divergence = d; }
+
+  // §4.3.5 issue(call): sync return for inline kinds, a promise for async kinds.
+  function issue(call) {
+    if (inClosure) throw typedError('SCRIPT_STEP_THREW', 'host call inside step()');
+    if (divergence) { if (call.settle === 'inline') throw typedError('JOURNAL_DIVERGENCE', 'aborted'); return never(); }
+    var seq = nextSeq;
+    var entry = journalBySeq[seq];
+    if (!entry && cancelling) throw typedError('RUN_CANCELLED', 'RUN_CANCELLED: the run is cancelling; no new intents may be issued');
+    if (!entry && seq >= MAX_EFFECTS) { abort({ reason: 'effect_cap', seq: seq }); throw typedError('EFFECT_CAP_EXCEEDED', 'EFFECT_CAP_EXCEEDED: more than ' + MAX_EFFECTS + ' effects in one run'); }
+    if (call.argsEnvelope !== undefined && byteSize(call.argsEnvelope) > ARGS_MAX) throw typedError('ARGS_TOO_LARGE', 'ARGS_TOO_LARGE: argsEnvelope over ' + ARGS_MAX + ' bytes');
+    nextSeq++;
+    issuedCount++;
+    var hash = callHash(call.kind, call.argsForHash);
+    if (entry) {
+      if (entry.callHash !== hash) {
+        abort({ reason: 'hash_mismatch', seq: seq, expected: entry.callHash, got: hash });
+        if (call.settle === 'inline') throw typedError('JOURNAL_DIVERGENCE', 'hash mismatch at seq ' + seq);
+        return never();
+      }
+      if (entry.settle === 'inline') {
+        if (call.settlesAsPromise) { var d0 = deferred(); if (entry.status === 'failed' || entry.error) d0.reject(typedError((entry.error && entry.error.code) || 'MEMO_THREW', entry.error && entry.error.message)); else d0.resolve(entry.output); return d0.promise; }
+        if (entry.error) throw typedError(entry.error.code, entry.error.message);
+        return entry.output;
+      }
+      if (entry.status === 'pending') return never();
+      var d = deferred(); pending[seq] = { d: d, kind: call.kind }; return d.promise;
+    }
+    // Fresh call — no journal row.
+    if (call.settle === 'inline') {
+      if (call.computeAsync) {
+        var d1 = deferred();
+        var started = nowReal();
+        // memo/step(): host members are throwing stubs for the closure's
+        // synchronous extent (05 §5.7.4 "effects are issued by the script,
+        // never by a step"); the awaited tail cannot reach a timer or fetch.
+        Promise.resolve().then(function () { if (call.closure) inClosure = true; try { return call.computeAsync(); } finally { inClosure = false; } }).then(function (out) {
+          var rec = { seq: seq, kind: call.kind, settle: 'inline', callHash: hash, argsEnvelope: call.argsEnvelope, status: 'completed', output: out === undefined ? null : out, durationMs: nowReal() - started };
+          if (call.narration) rec.narration = call.narration;
+          if (byteSize(out) > STEP_OUT_MAX) { rec.status = 'failed'; delete rec.output; rec.error = { code: 'OUTPUT_TOO_LARGE', message: 'inline result over ' + STEP_OUT_MAX + ' bytes' }; intents.push(rec); d1.reject(typedError('OUTPUT_TOO_LARGE', rec.error.message)); return; }
+          intents.push(rec); d1.resolve(out);
+        }, function (err) {
+          var es = errShape(err); es = call.kind === 'code' ? { code: 'SCRIPT_STEP_THREW', message: es.message } : { code: 'MEMO_THREW', message: es.message };
+          var rec = { seq: seq, kind: call.kind, settle: 'inline', callHash: hash, argsEnvelope: call.argsEnvelope, status: 'failed', error: es, durationMs: nowReal() - started };
+          if (call.narration) rec.narration = call.narration;
+          intents.push(rec); d1.reject(typedError(es.code, es.message));
+        });
+        return d1.promise;
+      }
+      var output = call.compute ? call.compute() : undefined;
+      var rec2 = { seq: seq, kind: call.kind, settle: 'inline', callHash: hash, argsEnvelope: call.argsEnvelope, status: 'completed', output: output === undefined ? null : output };
+      if (call.narration) rec2.narration = call.narration;
+      intents.push(rec2);
+      return output;
+    }
+    var asyncRec = { seq: seq, kind: call.kind, settle: 'async', callHash: hash, argsEnvelope: call.argsEnvelope };
+    if (call.narration) asyncRec.narration = call.narration;
+    if (call.role !== undefined) asyncRec.role = call.role;
+    if (call.model !== undefined) asyncRec.model = call.model;
+    intents.push(asyncRec);
+    var outstanding = 0; for (var q = 0; q < intents.length; q++) if (intents[q].settle === 'async') outstanding++;
+    if (outstanding > MAX_OUTSTANDING) {
+      // Thrown to the script with NO seq consumed (deterministic: the same
+      // prefix always trips at the same call) — the over-cap intent is never proposed.
+      intents.pop(); nextSeq--; issuedCount--;
+      throw typedError('OUTSTANDING_INTENTS_EXCEEDED', 'OUTSTANDING_INTENTS_EXCEEDED: more than ' + MAX_OUTSTANDING + ' unsettled intents in one tick');
+    }
+    return never();
+  }
+
+  function narr(opts) { var n = {}; if (opts && opts.label) n.label = String(opts.label); var ph = (opts && opts.phase) || currentPhase; if (ph) n.phase = String(ph); return (n.label || n.phase) ? n : undefined; }
+  function resolveModel(opts) {
+    if (opts && opts.model) return opts.model;
+    var ph = (opts && opts.phase) || currentPhase; var phases = __input.meta && __input.meta.phases;
+    if (ph && Array.isArray(phases)) for (var i = 0; i < phases.length; i++) if (phases[i] && phases[i].title === ph && phases[i].model) return phases[i].model;
+    return undefined;
+  }
+  function resolveRole(role) {
+    if (role === undefined) return undefined;
+    if (role && typeof role === 'object' && typeof role.ref === 'string') {
+      var keys = Object.keys(role); if (keys.length > 1) throw typedError('EPHEMERAL_ROLE_INVALID', 'role ref mixed with inline keys', { reason: 'ref_and_inline' });
+      var b = __input.roleBindings && __input.roleBindings[role.ref];
+      if (!b) throw typedError('EPHEMERAL_ROLE_INVALID', 'unknown role ref ' + role.ref, { reason: 'ref_unknown' });
+      return b;
+    }
+    if (role && typeof role === 'object') {
+      if (typeof role.instructions === 'string' && role.instructions.length > 4000) throw typedError('EPHEMERAL_ROLE_INVALID', 'role.instructions over 4000 chars', { reason: 'too_long' });
+      if (Array.isArray(role.tools) && role.tools.length > 64) throw typedError('EPHEMERAL_ROLE_INVALID', 'role.tools over 64', { reason: 'too_many_tools' });
+    }
+    return role;
+  }
+  function checkItems(items) { if (!Array.isArray(items)) throw new TypeError('expected an array'); if (items.length > MAX_FOREACH) throw typedError('TOO_MANY_ITEMS', 'foreach_too_many_items', { itemCount: items.length, cap: MAX_FOREACH }); }
+  function thunkOrNull(fn) { try { return Promise.resolve(fn()).catch(function () { return null; }); } catch (e) { return Promise.resolve(null); } }
+
+  var host = {
+    args: __input.args,
+    agent: function (prompt, opts) {
+      var o = opts || {};
+      var role = resolveRole(o.role);
+      if (role !== undefined && o.agentId !== undefined && o.agentId !== '$self') throw typedError('EPHEMERAL_ROLE_INVALID', 'a role step must run on the owner', { reason: 'base_not_self' });
+      var model = resolveModel(o);
+      var afh = { prompt: prompt, agentId: o.agentId, schema: o.schema, model: model, toolScope: o.toolScope, timeoutSeconds: o.timeoutSeconds, data: o.data };
+      if ('role' in o) afh.role = role;
+      var env = { prompt: prompt }; for (var k in o) if (k !== 'role') env[k] = o[k]; if ('role' in o) env.role = role; if (model !== undefined) env.model = model;
+      return issue({ kind: 'agent', settle: 'async', argsForHash: afh, argsEnvelope: env, narration: narr(o), role: ('role' in o) ? role : undefined, model: model });
+    },
+    tool: function (toolId, input, opts) { var o = opts || {}; var env = { toolId: toolId, input: input }; for (var k in o) env[k] = o[k]; return issue({ kind: 'tool', settle: 'async', argsForHash: { toolId: toolId, input: input, timeoutSeconds: o.timeoutSeconds }, argsEnvelope: env, narration: narr(o) }); },
+    shell: function (command, opts) { var o = opts || {}; var env = { command: command }; for (var k in o) env[k] = o[k]; return issue({ kind: 'code', settle: 'async', argsForHash: { command: command, timeoutSeconds: o.timeoutSeconds, workspace: o.workspace, jobResources: o.jobResources }, argsEnvelope: env, narration: narr(o) }); },
+    merge: function (opts) { var o = opts || {}; return issue({ kind: 'merge', settle: 'async', argsForHash: { strategy: o.strategy, onConflict: o.onConflict, arms: o.arms }, argsEnvelope: o, narration: narr(o) }); },
+    workflow: function (nameOrGraph, input, opts) {
+      var o = opts || {};
+      var ref = typeof nameOrGraph === 'string' ? nameOrGraph : 'sha256-cj1:' + sha256Hex(canonicalJson(nameOrGraph && nameOrGraph.definition !== undefined ? { definition: nameOrGraph.definition } : nameOrGraph));
+      return issue({ kind: 'workflow', settle: 'async', argsForHash: { ref: ref, input: input }, argsEnvelope: { workflow: nameOrGraph, input: input, label: o.label, phase: o.phase }, narration: narr(o) });
+    },
+    sleep: function (ms, opts) { var env = { ms: ms }; if (opts && opts.businessHours) env.businessHours = opts.businessHours; return issue({ kind: 'sleep', settle: 'async', argsForHash: { ms: ms }, argsEnvelope: env }); },
+    sleepUntil: function (iso, opts) { var env = { iso: iso }; if (opts) for (var k in opts) env[k] = opts[k]; return issue({ kind: 'sleepUntil', settle: 'async', argsForHash: { iso: iso }, argsEnvelope: env }); },
+    approval: function (req) { var r = req || {}; return issue({ kind: 'approval', settle: 'async', argsForHash: { title: r.title, details: r.details, approver: r.approver, timeoutHours: r.timeoutHours, editable: r.editable }, argsEnvelope: r, narration: narr(r) }); },
+    waitForSignal: function (name, opts) { var o = opts || {}; var env = { name: name }; for (var k in o) env[k] = o[k]; return issue({ kind: 'signal', settle: 'async', argsForHash: { name: name, timeoutHours: o.timeoutHours, acceptedSources: o.acceptedSources }, argsEnvelope: env, narration: narr(o) }); },
+    step: function (label, fn, opts) {
+      var o = opts || {};
+      if (o.timeoutSeconds !== undefined && !(o.timeoutSeconds >= 1 && o.timeoutSeconds <= 600)) throw typedError('SCRIPT_META_INVALID', 'step timeoutSeconds outside 1..600', { reason: 'step-timeout-invalid' });
+      if (cancelling && journalBySeq[nextSeq] === undefined) throw typedError('RUN_CANCELLED', 'RUN_CANCELLED');
+      if (journalBySeq[nextSeq] === undefined) { if (stepCount >= STEPS_PER_TICK) throw typedError('script-step-too-many', 'more than ' + STEPS_PER_TICK + ' step() closures in one tick'); stepCount++; }
+      return issue({ kind: 'code', settle: 'inline', settlesAsPromise: true, closure: true, argsForHash: { label: label, fn: String(fn) }, argsEnvelope: { label: label, timeoutSeconds: o.timeoutSeconds }, computeAsync: fn, narration: { label: String(label) } });
+    },
+    memo: function (key, fn) { return issue({ kind: 'memo', settle: 'inline', settlesAsPromise: true, closure: true, argsForHash: { key: key }, argsEnvelope: { key: key }, computeAsync: fn }); },
+    now: function () { if (envCount++ >= ENV_CAP && journalBySeq[nextSeq] === undefined) throw typedError('ENV_CAP_EXCEEDED', 'ENV_CAP_EXCEEDED'); return issue({ kind: 'env', settle: 'inline', argsForHash: { fn: 'now' }, argsEnvelope: { fn: 'now' }, compute: nowReal }); },
+    random: function () { if (envCount++ >= ENV_CAP && journalBySeq[nextSeq] === undefined) throw typedError('ENV_CAP_EXCEEDED', 'ENV_CAP_EXCEEDED'); return issue({ kind: 'env', settle: 'inline', argsForHash: { fn: 'random' }, argsEnvelope: { fn: 'random' }, compute: randomReal }); },
+    uuid: function () { if (envCount++ >= ENV_CAP && journalBySeq[nextSeq] === undefined) throw typedError('ENV_CAP_EXCEEDED', 'ENV_CAP_EXCEEDED'); return issue({ kind: 'env', settle: 'inline', argsForHash: { fn: 'uuid' }, argsEnvelope: { fn: 'uuid' }, compute: uuidReal }); },
+    log: function (message) {
+      var m = String(message).slice(0, 1024);
+      if (logCount >= LOG_CAP) { if (logCount === LOG_CAP) narration.push({ kind: 'log', message: 'LOG_CAP' }); logCount++; return; }
+      logCount++; narration.push({ kind: 'log', message: m });
+      issue({ kind: 'log', settle: 'inline', argsForHash: { message: m }, argsEnvelope: { message: m }, compute: function () { return undefined; } });
+    },
+    phase: function (title) {
+      var t = String(title);
+      if (phaseCount >= PHASE_CAP) { if (phaseCount === PHASE_CAP) narration.push({ kind: 'phase', message: 'PHASE_CAP' }); phaseCount++; return; }
+      phaseCount++; currentPhase = t; narration.push({ kind: 'phase', title: t });
+      issue({ kind: 'phase', settle: 'inline', argsForHash: { title: t }, argsEnvelope: { title: t }, compute: function () { return undefined; } });
+    },
+    parallel: function (thunks) { checkItems(thunks); var ps = []; for (var i = 0; i < thunks.length; i++) ps.push(thunkOrNull(thunks[i])); return Promise.all(ps); },
+    pipeline: function (items) {
+      checkItems(items); var stages = Array.prototype.slice.call(arguments, 1);
+      return Promise.all(items.map(function (item, i) { var p = Promise.resolve(undefined); stages.forEach(function (st) { p = p.then(function (prev) { return st(prev, item, i); }); }); return p; }));
+    },
+    foreach: function (items, opts, fn) {
+      if (typeof opts === 'function') { fn = opts; opts = {}; }
+      checkItems(items); var o = opts || {};
+      var conc = Math.max(1, Math.min(32, o.concurrency || 8)); var results = new Array(items.length); var next = 0;
+      function worker() { if (next >= items.length) return Promise.resolve(); var i = next++; return Promise.resolve().then(function () { return fn(items[i], i); }).then(function (v) { results[i] = v; }, function () { results[i] = null; }).then(worker); }
+      var ws = []; for (var w = 0; w < Math.min(conc, items.length); w++) ws.push(worker());
+      return Promise.all(ws).then(function () { return results; });
+    },
+    bailRun: function (output) { if (byteSize(output) > 262144) throw typedError('OUTPUT_TOO_LARGE', 'bailRun output over 256 KB'); bailed = { output: output === undefined ? null : output, seq: nextSeq }; throw typedError('__LUA_BAIL_RUN__', 'bailRun'); },
+    artefacts: {
+      put: function (name, data, opts) { var o = opts || {}; var digest = typeof data === 'string' ? sha256Hex(data) : sha256Hex(String(data)); return issue({ kind: 'artefact', settle: 'async', argsForHash: { op: 'put', name: name, sha256: digest, contentType: o.contentType, kind: o.kind, title: o.title, source: o.source }, argsEnvelope: { op: 'put', name: name, sha256: digest, contentType: o.contentType, kind: o.kind, title: o.title, source: o.source, bytes: typeof data === 'string' ? data.length : undefined } }); },
+      get: function (artefactId) { return issue({ kind: 'artefact', settle: 'async', argsForHash: { op: 'get', artefactId: artefactId }, argsEnvelope: { op: 'get', artefactId: artefactId } }); },
+      list: function () { return issue({ kind: 'artefact', settle: 'async', argsForHash: { op: 'list' }, argsEnvelope: { op: 'list' } }); },
+    },
+  };
+
+  // 04 §4.3.5 null-vs-reject table.
+  function settle(p, entry) {
+    if (entry.status === 'cancelled') { cancelling = true; p.d.resolve(null); return; }
+    if (entry.status === 'completed') { p.d.resolve(p.kind === 'sleep' || p.kind === 'sleepUntil' ? undefined : entry.output); return; }
+    switch (p.kind) {
+      case 'agent': case 'tool': case 'code': case 'merge': p.d.resolve(null); return;
+      case 'sleep': case 'sleepUntil': p.d.resolve(undefined); return;
+      case 'approval': case 'signal': p.d.resolve(entry.output === undefined ? null : entry.output); return;
+      default: p.d.reject(typedError((entry.error && entry.error.code) || 'UNKNOWN', (entry.error && entry.error.message) || 'journaled failure'));
+    }
+  }
+
+  var body = { settled: false, resolved: false, value: undefined, error: null };
+  return (async function () {
+    var bodyPromise;
+    try { bodyPromise = Promise.resolve().then(function () { return __bodyFactory(host)(); }); }
+    catch (e) { bodyPromise = Promise.reject(e); }
+    bodyPromise.then(function (v) { body.settled = true; body.resolved = true; body.value = v; }, function (e) { body.settled = true; body.resolved = false; body.error = e; });
+    // round 0
+    await drain();
+    // rounds 1..N in completionSeq order (inline entries never participate)
+    var applied = journal.filter(function (e) { return e.settle === 'async' && e.status !== 'pending'; })
+      .sort(function (a, b) { return (a.completionSeq == null ? Number.MAX_SAFE_INTEGER : a.completionSeq) - (b.completionSeq == null ? Number.MAX_SAFE_INTEGER : b.completionSeq); });
+    for (var i = 0; i < applied.length; i++) {
+      if (divergence || bailed) break;
+      var entry = applied[i];
+      if (entry.seq >= nextSeq) { abort({ reason: 'entry_before_issue', seq: entry.seq }); break; }
+      var p = pending[entry.seq];
+      if (p) { delete pending[entry.seq]; settle(p, entry); }
+      await drain();
+    }
+    if (!divergence && !bailed) for (var k = 0; k < journal.length; k++) if (journal[k].settle === 'async' && journal[k].seq >= nextSeq) { abort({ reason: 'journal_longer_than_script', seq: journal[k].seq }); break; }
+    var base = { __lua_workflow: 'script', intents: intents, issued: issuedCount, narration: narration };
+    if (divergence) {
+      if (divergence.reason === 'effect_cap') return Object.assign(base, { outcome: 'failed', error: { code: 'EFFECT_CAP_EXCEEDED', message: 'EFFECT_CAP_EXCEEDED at seq ' + divergence.seq } });
+      return Object.assign(base, { outcome: 'failed', error: { code: 'JOURNAL_DIVERGENCE', message: 'JOURNAL_DIVERGENCE(' + divergence.reason + ') at seq ' + divergence.seq, divergence: divergence } });
+    }
+    if (bailed) return Object.assign(base, { outcome: 'bailed', output: bailed.output, bailSeq: bailed.seq });
+    if (body.settled) {
+      if (body.resolved) { if (byteSize(body.value) > 262144) return Object.assign(base, { outcome: 'failed', error: { code: 'OUTPUT_TOO_LARGE', message: 'script return value over 256 KB' } }); return Object.assign(base, { outcome: 'done', output: body.value === undefined ? null : body.value }); }
+      var es = errShape(body.error); if (es.code === '__LUA_BAIL_RUN__' && bailed) return Object.assign(base, { outcome: 'bailed', output: bailed.output, bailSeq: bailed.seq });
+      return Object.assign(base, { outcome: 'failed', error: { code: es.code === 'SCRIPT_THREW' || !es.code ? 'SCRIPT_THREW' : es.code, message: es.message } });
+    }
+    var asyncIntents = intents.filter(function (it) { return it.settle === 'async'; });
+    if (asyncIntents.length === 0 && pendingCount === 0 && !journal.some(function (e) { return e.settle === 'async' && e.status === 'pending'; })) {
+      return Object.assign(base, { outcome: 'failed', error: { code: 'ORCHESTRATION_DEADLOCK', message: 'script parked with no intents and no pending effects' } });
+    }
+    return Object.assign(base, { outcome: 'parked', phaseTree: narration.filter(function (n) { return n.kind === 'phase'; }), stateSnapshot: undefined });
+  })();
+})`;
+var WORKFLOW_SCRIPT_REPLAY_SOURCES = Object.freeze({
+  [WORKFLOW_SCRIPT_PROTOCOL_VERSION]: WORKFLOW_SCRIPT_REPLAY_SOURCE
+});
+var WORKFLOW_SCRIPT_PROTOCOL_VERSIONS = Object.freeze(Object.keys(WORKFLOW_SCRIPT_REPLAY_SOURCES).map(Number).filter((v) => v <= WORKFLOW_SCRIPT_PROTOCOL_VERSION && v >= WORKFLOW_SCRIPT_PROTOCOL_VERSION - 2).sort((a, b) => b - a));
+var WORKFLOW_SCRIPT_PROTOCOL_INTRODUCED_AT = Object.freeze({
+  1: "2026-08-30"
+});
+function computeWorkflowProtocolShipWindow(input) {
+  const { current } = input;
+  const held = [
+    ...new Set(input.held)
+  ].filter((v) => v <= current).sort((a, b) => b - a);
+  const prev = held.includes(current - 1) ? current - 1 : void 0;
+  const prev2 = held.includes(current - 2) ? current - 2 : void 0;
+  const introduced = Date.parse(input.introducedAt[current] ?? "");
+  const now = input.now ?? Date.now();
+  const ageMs = Number.isFinite(introduced) ? Math.max(0, now - introduced) : 0;
+  if (prev === void 0) {
+    return {
+      versions: [
+        current
+      ],
+      dropped: held.filter((v) => v !== current),
+      state: "single",
+      ageMs
+    };
+  }
+  const elapsed = Number.isFinite(introduced) && ageMs >= input.drainDays * 864e5;
+  if (elapsed && input.stragglers === 0) {
+    return {
+      versions: [
+        current
+      ],
+      dropped: held.filter((v) => v !== current),
+      state: "drained",
+      ageMs
+    };
+  }
+  const versions = [
+    current,
+    prev,
+    ...prev2 !== void 0 ? [
+      prev2
+    ] : []
+  ];
+  return {
+    versions,
+    dropped: held.filter((v) => !versions.includes(v)),
+    state: elapsed ? "blocked" : "draining",
+    ageMs
+  };
+}
+__name(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
+__name7(computeWorkflowProtocolShipWindow, "computeWorkflowProtocolShipWindow");
+function workflowScriptReplaySource(journalProtocolVersion) {
+  return WORKFLOW_SCRIPT_PROTOCOL_VERSIONS.includes(journalProtocolVersion) ? WORKFLOW_SCRIPT_REPLAY_SOURCES[journalProtocolVersion] : void 0;
+}
+__name(workflowScriptReplaySource, "workflowScriptReplaySource");
+__name7(workflowScriptReplaySource, "workflowScriptReplaySource");
+var HOST_BINDINGS = [
+  "args",
+  "agent",
+  "tool",
+  "shell",
+  "merge",
+  "workflow",
+  "sleep",
+  "sleepUntil",
+  "approval",
+  "waitForSignal",
+  "step",
+  "memo",
+  "now",
+  "random",
+  "uuid",
+  "log",
+  "phase",
+  "parallel",
+  "pipeline",
+  "foreach",
+  "bailRun",
+  "artefacts"
+];
+function transformWorkflowScriptModule(script) {
+  return script.replace(/^\s*export\s+const\s+meta\s*=/m, "const meta =");
+}
+__name(transformWorkflowScriptModule, "transformWorkflowScriptModule");
+__name7(transformWorkflowScriptModule, "transformWorkflowScriptModule");
+function buildWorkflowScriptWrapper(script, input) {
+  const tick = input ?? {};
+  const version = tick.journalProtocolVersion ?? WORKFLOW_SCRIPT_PROTOCOL_VERSION;
+  const replaySource = workflowScriptReplaySource(version);
+  if (replaySource === void 0) {
+    return {
+      code: `
+{
+  const __platformErr = new Error('[Lua] workflow-script journalProtocolVersion ${JSON.stringify(version)} is outside this runner window ${JSON.stringify(WORKFLOW_SCRIPT_PROTOCOL_VERSIONS)}');
+  __platformErr.code = 'runtime_incompatible';
+  throw __platformErr;
+}
+`,
+      contextName: "WorkflowScriptExecutionContext",
+      contextOrigin: "workflow-script-execution",
+      source: "workflow-script",
+      timeoutMs: 6e5
+    };
+  }
+  const bindings = HOST_BINDINGS.map((k) => `${k} = __host.${k}`).join(", ");
+  const code = `
+const __luaWfRt = globalThis[${JSON.stringify(WORKFLOW_SCRIPT_RUNTIME_KEY)}];
+delete globalThis[${JSON.stringify(WORKFLOW_SCRIPT_RUNTIME_KEY)}];
+if (!__luaWfRt || typeof __luaWfRt.setImmediate !== 'function' || typeof __luaWfRt.sha256Hex !== 'function') {
+  const __platformErr = new Error('[Lua] workflow-script runtime handle missing \u2014 the site was dispatched outside the workflows queue set');
+  __platformErr.code = 'PLATFORM_VM_ERROR';
+  throw __platformErr;
+}
+const __luaWfInput = ${JSON.stringify(input ?? null)};
+const __luaWfReplay = ${replaySource};
+__luaWfReplay(__luaWfRt, __luaWfInput, function (__host) {
+  const ${bindings};
+  return async function __luaWorkflowScriptBody() {
+${transformWorkflowScriptModule(script)}
+  };
+});
+`;
+  return {
+    code,
+    contextName: "WorkflowScriptExecutionContext",
+    contextOrigin: "workflow-script-execution",
+    source: "workflow-script",
+    // The tick wall is the sum of orchestration (LUA_WF_SCRIPT_WALL_MS, 30 s)
+    // and step() closure walls; the process hard wall stays the site's
+    // LUA_SANDBOX_MAX_EXECUTION_MS (05 §5.7.4 clock 3) — envelope wallMs overrides.
+    timeoutMs: 6e5
+  };
+}
+__name(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
+__name7(buildWorkflowScriptWrapper, "buildWorkflowScriptWrapper");
+
+// src/utils/workflow-script-replay.ts
 var ReplayRuntimeUnavailableError = class extends Error {
   static {
     __name(this, "ReplayRuntimeUnavailableError");
@@ -35337,7 +36507,59 @@ function compareScriptReplay(bundle, result) {
   };
 }
 __name(compareScriptReplay, "compareScriptReplay");
-function loadLocalScriptRunner(projectDir = process.cwd()) {
+var QUIET_CONSOLE = {
+  log() {
+  },
+  info() {
+  },
+  warn() {
+  },
+  error() {
+  },
+  debug() {
+  }
+};
+function runWrapper(code, sandbox, tick, filename) {
+  const context = vm5.createContext(sandbox);
+  const value3 = vm5.runInContext(code, context, {
+    filename,
+    timeout: Math.max(1e3, tick.caps?.scriptWallMs ?? 3e4)
+  });
+  return Promise.resolve(value3);
+}
+__name(runWrapper, "runWrapper");
+function localScriptRuntimeHandle() {
+  const realSetImmediate = setImmediate;
+  const RealDate = Date;
+  const realRandom = Math.random;
+  return {
+    setImmediate: /* @__PURE__ */ __name((cb) => realSetImmediate(cb), "setImmediate"),
+    now: /* @__PURE__ */ __name(() => RealDate.now(), "now"),
+    random: /* @__PURE__ */ __name(() => realRandom(), "random"),
+    uuid: /* @__PURE__ */ __name(() => randomUUID4(), "uuid"),
+    sha256Hex: /* @__PURE__ */ __name((text) => createHash7("sha256").update(text).digest("hex"), "sha256Hex")
+  };
+}
+__name(localScriptRuntimeHandle, "localScriptRuntimeHandle");
+function bundledScriptRunner() {
+  const runner = /* @__PURE__ */ __name(async (tick) => {
+    const sandbox = createBaseSandboxContext({
+      envVars: {},
+      customConsole: QUIET_CONSOLE,
+      extraGlobals: {
+        ...buildWorkflowScriptGlobals(QUIET_CONSOLE),
+        [WORKFLOW_SCRIPT_RUNTIME_KEY]: localScriptRuntimeHandle()
+      }
+    });
+    const wrapper = buildWorkflowScriptWrapper(tick.script, tick);
+    return runWrapper(wrapper.code, sandbox, tick, "workflow-script-local.js");
+  }, "runner");
+  return Object.assign(runner, {
+    runtime: "bundled"
+  });
+}
+__name(bundledScriptRunner, "bundledScriptRunner");
+function projectScriptRunner(projectDir) {
   let runtime;
   try {
     const req = createRequire2(`${projectDir.replace(/\/$/, "")}/package.json`);
@@ -35348,35 +36570,37 @@ function loadLocalScriptRunner(projectDir = process.cwd()) {
   if (typeof runtime?.createSandboxContext !== "function" || typeof runtime?.buildWorkflowScriptWrapper !== "function") {
     throw new ReplayRuntimeUnavailableError("runtime exports missing");
   }
-  return async (tick) => {
-    const quiet = {
-      log() {
-      },
-      info() {
-      },
-      warn() {
-      },
-      error() {
-      },
-      debug() {
-      }
-    };
+  const runner = /* @__PURE__ */ __name(async (tick) => {
     const sandbox = runtime.createSandboxContext({
       siteType: "workflow-script"
-    }, void 0, void 0, quiet, void 0, {});
+    }, void 0, void 0, QUIET_CONSOLE, void 0, {});
     const wrapper = runtime.buildWorkflowScriptWrapper(tick.script, tick);
-    const context = vm5.createContext(sandbox);
-    const value3 = vm5.runInContext(wrapper.code, context, {
-      filename: "workflow-script-replay.js",
-      timeout: Math.max(1e3, tick.caps?.scriptWallMs ?? 3e4)
-    });
-    return await value3;
-  };
+    return runWrapper(wrapper.code, sandbox, tick, "workflow-script-replay.js");
+  }, "runner");
+  return Object.assign(runner, {
+    runtime: "project"
+  });
+}
+__name(projectScriptRunner, "projectScriptRunner");
+function loadLocalScriptRunner(projectDir = process.cwd(), opts = {}) {
+  const mode = opts.runtime ?? "auto";
+  if (mode === "bundled") return bundledScriptRunner();
+  try {
+    return projectScriptRunner(projectDir);
+  } catch (e) {
+    if (mode === "project" || !(e instanceof ReplayRuntimeUnavailableError)) throw e;
+    return bundledScriptRunner();
+  }
 }
 __name(loadLocalScriptRunner, "loadLocalScriptRunner");
 async function replayScriptRunLocally(bundle, runner = loadLocalScriptRunner()) {
   const result = await runner(bundle.tick);
-  return compareScriptReplay(bundle, result);
+  const report = compareScriptReplay(bundle, result);
+  const runtime = runner.runtime;
+  return runtime ? {
+    ...report,
+    runtime
+  } : report;
 }
 __name(replayScriptRunLocally, "replayScriptRunLocally");
 function formatScriptReplayReport(r) {
@@ -35385,6 +36609,9 @@ function formatScriptReplayReport(r) {
     lines.push(`j${row2.seq} \xB7 ${row2.kind} \xB7 recorded=${row2.recordedHash.slice(0, 20)}\u2026 \xB7 local=${(row2.localHash ?? "-").slice(0, 20)}\u2026${row2.diverged ? ` \xB7 DIVERGED (${row2.reason})` : ""}`);
   }
   lines.push(`local outcome: ${r.localOutcome}${r.localError ? ` (${r.localError.code}: ${r.localError.message})` : ""} \xB7 server status: ${r.serverStatus} \xB7 new intents: ${r.newIntents}`);
+  if (r.runtime) {
+    lines.push(`wrapper: ${r.runtime === "project" ? "the project's @lua/sandbox-runtime" : "bundled with this lua-cli"} (LUA-751)`);
+  }
   return lines;
 }
 __name(formatScriptReplayReport, "formatScriptReplayReport");
@@ -35529,15 +36756,15 @@ async function runWorkflowLocalFromProject(name, flags) {
   }, "say");
   if (!flags.noCompile) {
     say("\u{1F4E6} Compiling code first...");
-    await compileCommand({
+    await withStdoutToStderr(asJson, () => compileCommand({
       serverSync: false
-    });
+    }));
   }
   const manifest = loadManifest();
   const workflows = getPrimitivesByKind(manifest, PrimitiveKind.WORKFLOW);
   if (workflows.length === 0) {
     console.error("\u274C No workflows found in compiled output.");
-    console.log("\u{1F4A1} Create a workflow with createWorkflow(...).commit() in your code.");
+    (asJson ? console.error : console.log)("\u{1F4A1} Create a workflow with createWorkflow(...).commit() in your code.");
     return {
       exitCode: 3
     };
@@ -36640,6 +37867,72 @@ init_command_utils();
 init_semver();
 init_auth_error();
 init_constants();
+
+// src/api/agent-version.api.service.ts
+init_http_client();
+var AgentVersionApi = class extends HttpClient {
+  static {
+    __name(this, "AgentVersionApi");
+  }
+  agentId;
+  constructor(baseUrl, credential, agentId) {
+    super(baseUrl, credential);
+    this.agentId = agentId;
+  }
+  get basePath() {
+    return `/developer/agents/${encodeURIComponent(this.agentId)}`;
+  }
+  get authHeader() {
+    return {};
+  }
+  // ---------------------------------------------------------------------------
+  // Version CRUD
+  // ---------------------------------------------------------------------------
+  async createVersion(body) {
+    return this.httpPost(`${this.basePath}/versions`, body, this.authHeader);
+  }
+  async listVersions(query) {
+    const params = new URLSearchParams();
+    if (query?.all !== void 0) params.append("all", String(query.all));
+    if (query?.limit !== void 0) params.append("limit", String(query.limit));
+    if (query?.status !== void 0) params.append("status", query.status);
+    const qs = params.toString();
+    const url = qs ? `${this.basePath}/versions?${qs}` : `${this.basePath}/versions`;
+    return this.httpGet(url, this.authHeader);
+  }
+  async getVersion(version) {
+    return this.httpGet(`${this.basePath}/versions/${version}`, this.authHeader);
+  }
+  async deleteVersion(version) {
+    return this.httpDelete(`${this.basePath}/versions/${version}`, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Diff
+  // ---------------------------------------------------------------------------
+  async diffVersions(from, to) {
+    const url = `${this.basePath}/versions/diff?from=${from}&to=${to}`;
+    return this.httpGet(url, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Promote
+  // ---------------------------------------------------------------------------
+  async promoteVersion(version) {
+    return this.httpPost(`${this.basePath}/versions/${version}/promote`, {}, this.authHeader);
+  }
+  // ---------------------------------------------------------------------------
+  // Patch commit hash — called by `lua version create` after a successful git
+  // commit + tag to propagate the SHA to the backend AgentVersion record.
+  // Failure is non-fatal; the version snapshot is valid whether or not this
+  // PATCH lands.
+  // ---------------------------------------------------------------------------
+  async patchCommitHash(version, commitHash) {
+    return this.httpPatch(`${this.basePath}/versions/${version}/commit-hash`, {
+      commitHash
+    }, this.authHeader);
+  }
+};
+
+// src/commands/push.ts
 init_artifact_loader();
 init_bundle_upload();
 init_types();
@@ -37479,6 +38772,7 @@ var GIT_MESSAGES = {
 var tagName = /* @__PURE__ */ __name((version) => `lua/v${version}`, "tagName");
 
 // src/commands/push-helpers.ts
+init_cli_error();
 function pickPushAllNextStepVariant(opts) {
   if (opts.pushedSomething && opts.failedCount === 0) return "success";
   if (opts.pushedSomething && opts.failedCount > 0) return "partial";
@@ -37501,6 +38795,15 @@ function formatPushFailureSummary(failedItems) {
   return lines.join("\n");
 }
 __name(formatPushFailureSummary, "formatPushFailureSummary");
+function stalePushEntryError(handler, name, entityId, serverMessage) {
+  const field = handler.yamlConfig.idField;
+  return new CliError("not_found", `${handler.displayName} "${name}" (${entityId}) no longer exists on the server${serverMessage ? ` \u2014 ${serverMessage}` : ""}`, {
+    exitCode: CLI_EXIT.NOT_FOUND,
+    statusCode: 404,
+    hint: `lua.skill.yaml still holds ${field}: ${entityId} for "${name}". Run \`lua compile\` \u2014 the server sync clears a deleted id and registers the definition afresh \u2014 then push again; or remove the ${field} line by hand.`
+  });
+}
+__name(stalePushEntryError, "stalePushEntryError");
 
 // src/commands/push.ts
 function getDeployHint(type) {
@@ -37555,6 +38858,20 @@ async function authenticateOrFail() {
   return requireAuthOrExit(false);
 }
 __name(authenticateOrFail, "authenticateOrFail");
+async function agentHasVersions() {
+  try {
+    const agentId = readYamlConfig()?.agent?.agentId;
+    if (!agentId) return false;
+    const apiKey = await requireAuthOrExit(false);
+    const res = await new AgentVersionApi(BASE_URLS.API, apiKey, agentId).listVersions({
+      limit: 1
+    });
+    return !!res.success && Array.isArray(res.data) && res.data.length > 0;
+  } catch {
+    return false;
+  }
+}
+__name(agentHasVersions, "agentHasVersions");
 async function selectEntityOrFail(items, options, config) {
   const { entityType, nameFields = [
     "id",
@@ -37635,7 +38952,6 @@ async function pushVersionedPrimitive(handler, options = {}) {
     await compileCommand();
     writeSuccess("\u2705 Compilation complete");
     const apiKey = await authenticateOrFail();
-    writeSuccess("\u2705 Authentication verified");
     const config = readYamlConfig();
     if (!config?.agent?.agentId) {
       throw new Error("No agent ID found in lua.skill.yaml. Please run 'lua init' first.");
@@ -37685,6 +39001,7 @@ async function pushVersionedPrimitive(handler, options = {}) {
       version: confirmedVersion
     });
     if (!result.success) {
+      if (result.statusCode === 404) throw stalePushEntryError(handler, selected.name, entityId, result.error);
       const isVersionConflict = result.error?.toLowerCase().includes("already exists");
       if (isVersionConflict) {
         writeHintBlock({
@@ -37812,7 +39129,7 @@ async function pushCommand(type, cmdObj) {
         autoDeployNoopWarned: isAutoDeployNoOp
       });
     }
-    if (isGranular) {
+    if (isGranular && await agentHasVersions()) {
       writeInfo("\u26A0\uFE0F  Granular push is deprecated when agent versioning is on. Use `lua push` (no args) to stage all changes, then `lua version create`.");
     }
     if (type === "all") {
@@ -38091,7 +39408,6 @@ Model: ${model}`);
     }
   }
   const apiKey = await authenticateOrFail();
-  writeProgress("\u2705 Authenticated");
   const result = await agentHandler.pushAgentConfig(apiKey, agentId, manifest);
   let productionDeployedWithAutoDeploy = false;
   let personaDeployWasAttempted = false;
@@ -39830,70 +41146,6 @@ async function pushProcessorsToSandbox(apiKey, agentId, manifest, yamlConfig, is
 }
 __name(pushProcessorsToSandbox, "pushProcessorsToSandbox");
 
-// src/api/agent-version.api.service.ts
-init_http_client();
-var AgentVersionApi = class extends HttpClient {
-  static {
-    __name(this, "AgentVersionApi");
-  }
-  agentId;
-  constructor(baseUrl, credential, agentId) {
-    super(baseUrl, credential);
-    this.agentId = agentId;
-  }
-  get basePath() {
-    return `/developer/agents/${encodeURIComponent(this.agentId)}`;
-  }
-  get authHeader() {
-    return {};
-  }
-  // ---------------------------------------------------------------------------
-  // Version CRUD
-  // ---------------------------------------------------------------------------
-  async createVersion(body) {
-    return this.httpPost(`${this.basePath}/versions`, body, this.authHeader);
-  }
-  async listVersions(query) {
-    const params = new URLSearchParams();
-    if (query?.all !== void 0) params.append("all", String(query.all));
-    if (query?.limit !== void 0) params.append("limit", String(query.limit));
-    if (query?.status !== void 0) params.append("status", query.status);
-    const qs = params.toString();
-    const url = qs ? `${this.basePath}/versions?${qs}` : `${this.basePath}/versions`;
-    return this.httpGet(url, this.authHeader);
-  }
-  async getVersion(version) {
-    return this.httpGet(`${this.basePath}/versions/${version}`, this.authHeader);
-  }
-  async deleteVersion(version) {
-    return this.httpDelete(`${this.basePath}/versions/${version}`, this.authHeader);
-  }
-  // ---------------------------------------------------------------------------
-  // Diff
-  // ---------------------------------------------------------------------------
-  async diffVersions(from, to) {
-    const url = `${this.basePath}/versions/diff?from=${from}&to=${to}`;
-    return this.httpGet(url, this.authHeader);
-  }
-  // ---------------------------------------------------------------------------
-  // Promote
-  // ---------------------------------------------------------------------------
-  async promoteVersion(version) {
-    return this.httpPost(`${this.basePath}/versions/${version}/promote`, {}, this.authHeader);
-  }
-  // ---------------------------------------------------------------------------
-  // Patch commit hash — called by `lua version create` after a successful git
-  // commit + tag to propagate the SHA to the backend AgentVersion record.
-  // Failure is non-fatal; the version snapshot is valid whether or not this
-  // PATCH lands.
-  // ---------------------------------------------------------------------------
-  async patchCommitHash(version, commitHash) {
-    return this.httpPatch(`${this.basePath}/versions/${version}/commit-hash`, {
-      commitHash
-    }, this.authHeader);
-  }
-};
-
 // src/commands/chat.ts
 init_constants();
 
@@ -49002,6 +50254,7 @@ __name(formatSchedule2, "formatSchedule");
 
 // src/commands/workflows.ts
 init_cli();
+init_cli_error();
 init_constants();
 init_command_utils();
 init_analytics();
@@ -49020,7 +50273,9 @@ var WORKFLOW_EXIT = {
   RUN_CANCELLED: 5,
   RUN_GATED: 6,
   TIMEOUT: 7,
-  RUN_PARKED: 8
+  RUN_PARKED: 8,
+  /** No server verdict — 5xx, connection refused, timeout: the global class (`errors/cli.error.ts`). */
+  UNAVAILABLE: CLI_EXIT.UNAVAILABLE
 };
 var TERMINAL_FAILED = /* @__PURE__ */ new Set([
   "failed",
@@ -49218,13 +50473,14 @@ __name(emitJson, "emitJson");
 function apiFailure(ctx, res, verb) {
   emitJson(ctx, res);
   const err = res.error;
-  const status = err?.statusCode ?? 0;
+  const status = err?.statusCode;
   const code = err?.code ?? err?.error;
   if (!ctx.json) {
     if (status === 503 && code === "CONTROL_UNAVAILABLE") console.error(`\u274C ${verb}: ${CONTROL_UNAVAILABLE_HINT}`);
     else console.error(`\u274C ${verb} failed${code ? ` (${code})` : ""}: ${err?.message ?? "Unknown error"}`);
   }
   if (status === 404) return WORKFLOW_EXIT.NOT_FOUND;
+  if (status === 0 || status !== void 0 && status >= 500) return WORKFLOW_EXIT.UNAVAILABLE;
   return WORKFLOW_EXIT.API;
 }
 __name(apiFailure, "apiFailure");
@@ -49637,6 +50893,35 @@ async function statusCore(ctx, runId, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(statusCore, "statusCore");
+function runMetering(run) {
+  return run.usage?.metering === "priced" ? "priced" : "flat";
+}
+__name(runMetering, "runMetering");
+function budgetCopy(run) {
+  if (runMetering(run) === "priced") {
+    if (run.usage?.engine === "seat") return "charged like chat \u2014 actions (tier \xD7 model multiplier) per model call on your seat plan";
+    if (run.usage?.engine === "legacy") return "charged like chat \u2014 one credit per model call on the legacy plan";
+    return "charged like chat \u2014 one credit per model call on the legacy plan, or actions (tier \xD7 model multiplier) on a seat plan";
+  }
+  return "a credit is one agent step; a Job-tier attempt is 4 \u2014 tokens are never metered";
+}
+__name(budgetCopy, "budgetCopy");
+var fmtNum = /* @__PURE__ */ __name((v) => v.toLocaleString("en-US"), "fmtNum");
+function budgetLine(run) {
+  const u = run.usage;
+  const b = run.budget;
+  if (!u && !b) return void 0;
+  const seat = u?.engine === "seat" || b?.unit === "actions";
+  const spent = seat ? u?.actionsUsed ?? b?.spent?.actionsEstimate ?? 0 : u?.creditsUsed ?? b?.spent?.credits ?? 0;
+  const cap = runBudgetCap(b);
+  const parts = [
+    `${fmtNum(spent)}${cap !== void 0 ? ` of ${fmtNum(cap)}` : ""} ${seat ? "actions" : "credits"} spent`,
+    b?.remaining !== void 0 ? `${fmtNum(b.remaining)} remaining` : void 0,
+    seat && u?.creditsUsed ? `${fmtNum(u.creditsUsed)} flat credits` : void 0
+  ].filter((p) => !!p);
+  return `${parts.join(" \xB7 ")} (${budgetCopy(run)})`;
+}
+__name(budgetLine, "budgetLine");
 function printRun(run, withSteps) {
   const id = runIdOf(run);
   console.log(`
@@ -49646,6 +50931,8 @@ function printRun(run, withSteps) {
   console.log(`   Created:  ${when(run.createdAt)}${run.startedAt ? ` \xB7 started ${when(run.startedAt)}` : ""}${run.completedAt ? ` \xB7 completed ${when(run.completedAt)}` : ""}`);
   if (run.lineageId && run.lineageId !== id) console.log(`   Lineage:  ${run.lineageId}`);
   if (run.parentRunId) console.log(`   Parent:   ${run.parentRunId} \u2014 lua workflows status ${run.parentRunId} --steps`);
+  const budget = budgetLine(run);
+  if (budget) console.log(`   Budget:   ${budget}`);
   if (run.cancel) console.log(`   Cancel:   ${formatRunCancel(run.cancel)}`);
   if (run.gate) {
     const kind = run.gate.kind;
@@ -49654,7 +50941,8 @@ function printRun(run, withSteps) {
       console.log(`   lua workflows retry-step ${id} --step <id>`);
       console.log("   To skip, complete or fail the step, or start a repair run, decide it from the desktop run page.");
     } else if (kind === "budget") {
-      console.log("\n\u23F8\uFE0F  Paused \u2014 run budget reached (a credit is one agent step; a Job-tier attempt is 4 \u2014 tokens are never metered):");
+      console.log(`
+\u23F8\uFE0F  Paused \u2014 run budget reached (${budgetCopy(run)}):`);
       console.log(`   lua workflows raise-budget ${id} --credits <n>`);
     } else {
       console.log(`   Gate:     ${kind}${run.gate.reason ? ` (${run.gate.reason})` : ""}${run.gate.since ? ` since ${when(run.gate.since)}` : ""}`);
@@ -49693,7 +50981,7 @@ function printRun(run, withSteps) {
         s.stepId,
         s.kind ?? "\u2014",
         s.status,
-        String(s.attempt ?? ""),
+        stepAttemptCell(s),
         stepErrorCell(s.error),
         ...withChildren ? [
           s.childRunId ?? ""
@@ -49710,6 +50998,8 @@ function stepAttemptLines(s) {
   if (cause) out.push(`   \u2716 ${s.stepId}: ${cause}`);
   const burned = cause ? void 0 : attemptCountersLine(s);
   if (burned) out.push(`   \u03A3 ${s.stepId}: attempt ${s.attempt ?? 1} ${s.status}: ${burned}`);
+  const billed = stepBillingLine(s.billing);
+  if (billed) out.push(`   $ ${s.stepId}: attempt ${s.billing?.attempt ?? s.attempt ?? 1} billed: ${billed}`);
   for (const a of s.attempts ?? []) {
     if (a.status === "completed") continue;
     const what = stepErrorCell(a.error) || a.killReason || "\u2014";
@@ -49719,6 +51009,33 @@ function stepAttemptLines(s) {
   return out;
 }
 __name(stepAttemptLines, "stepAttemptLines");
+function stepAttemptCell(s) {
+  const attempt = typeof s.attempt === "number" ? String(s.attempt) : "";
+  if (typeof s.retriesRemaining === "number") {
+    const left = s.retriesRemaining;
+    return `${attempt} (${left === 0 ? "no retries" : left === 1 ? "1 retry" : `${left} retries`} left)`;
+  }
+  if (typeof s.maxAttempts === "number" && s.maxAttempts > 1 && attempt) return `${attempt}/${s.maxAttempts}`;
+  return attempt;
+}
+__name(stepAttemptCell, "stepAttemptCell");
+function stepBillingLine(b) {
+  if (!b) return void 0;
+  const legs = [
+    b.credits !== void 0 ? `${fmtNum(b.credits)} ${b.credits === 1 ? "credit" : "credits"}` : void 0,
+    b.actions !== void 0 ? `${fmtNum(b.actions)} ${b.actions === 1 ? "action" : "actions"}` : void 0
+  ].filter((p) => !!p);
+  const parts = [
+    legs.length ? legs.join(" + ") : "no charge",
+    b.engine === "seat" ? "seat plan" : "legacy plan",
+    b.tier ? `${b.tier} tier${b.multiplier !== void 0 ? ` \xD7 ${fmtNum(b.multiplier)}` : ""}` : void 0,
+    b.model ? `model ${b.model}` : void 0,
+    b.byok ? "BYOK" : void 0,
+    b.calibrated === false ? "uncalibrated model \u2014 fallback rate" : void 0
+  ].filter((p) => !!p);
+  return parts.join(" \xB7 ");
+}
+__name(stepBillingLine, "stepBillingLine");
 var RUN_TERMINAL_STATUSES = /* @__PURE__ */ new Set([
   "completed",
   "failed",
@@ -49836,6 +51153,7 @@ async function watchCore(ctx, runId, o) {
   } finally {
     if (timer) clearTimeout(timer);
     process.off("SIGINT", onSigint);
+    if (!controller.signal.aborted) controller.abort();
   }
   if (exit !== void 0) return exit;
   if (timedOut) {
@@ -49845,6 +51163,12 @@ async function watchCore(ctx, runId, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(watchCore, "watchCore");
+function throttledLine(throttled) {
+  return `throttled \xB7 ${[
+    ...throttled
+  ].map(([k, n2]) => `${k} \xD7${n2}`).join(" \xB7 ")}`;
+}
+__name(throttledLine, "throttledLine");
 function handleWatchFrame(ctx, runId, frame, o, throttled) {
   const data = frame.data ?? {};
   if (o.events || ctx.json) console.log(JSON.stringify({
@@ -49852,6 +51176,12 @@ function handleWatchFrame(ctx, runId, frame, o, throttled) {
     event: frame.event,
     data: frame.data
   }));
+  const humanBoundary = /* @__PURE__ */ __name((line, code) => {
+    if (!ctx.json) console.error(line);
+    if (!o.waitForHuman) return code;
+    if (!ctx.json) console.error("   --wait-for-human: still following \u2014 Ctrl+C or --timeout to stop");
+    return void 0;
+  }, "humanBoundary");
   switch (frame.event) {
     case "heartbeat":
       return void 0;
@@ -49873,9 +51203,7 @@ function handleWatchFrame(ctx, runId, frame, o, throttled) {
       if (type === "step.throttled") {
         const kind = String(ev.data?.kind ?? "throttled");
         throttled.set(kind, (throttled.get(kind) ?? 0) + 1);
-        if (!ctx.json && !o.events) process.stdout.write(`\r  throttled \xB7 ${[
-          ...throttled
-        ].map(([k, n2]) => `${k} \xD7${n2}`).join(" \xB7 ")}`);
+        if (!ctx.json && !o.events) process.stdout.write(`\r  ${throttledLine(throttled)}`);
         return void 0;
       }
       if (!ctx.json && !o.events) {
@@ -49887,29 +51215,30 @@ function handleWatchFrame(ctx, runId, frame, o, throttled) {
         const detail = subrun ? ` \xB7 ${subrun}` : ev.data ? ` ${JSON.stringify(scrubEventData(ev.data)).slice(0, 160)}` : "";
         console.log(`[${at}] ${type}${ev.stepId ? ` \xB7 ${ev.stepId}` : ""}${detail}`);
       }
-      if (type === "run.gated" && ev.data?.gate === "exception") {
-        if (!ctx.json) console.error(`\u26A0\uFE0F  run parked on an exception gate \u2014 a human decides next: lua workflows status ${runId}`);
-        return WORKFLOW_EXIT.RUN_PARKED;
-      }
-      if (type === "run.gated" && ev.data?.gate === "billing") {
+      if (type === "run.gated") {
+        const gate = ev.data?.gate;
         const stepId = ev.data?.stepId;
-        if (!ctx.json) console.error(`\u23F8\uFE0F  run parked on a billing gate \u2014 top up, then: lua workflows retry-step ${runId} --step ${stepId ?? "<stepId>"}`);
-        return WORKFLOW_EXIT.RUN_PARKED;
+        if (gate === "exception") {
+          return humanBoundary(`\u26A0\uFE0F  run parked on an exception gate \u2014 a human decides next: lua workflows status ${runId}`, WORKFLOW_EXIT.RUN_PARKED);
+        }
+        if (gate === "billing") {
+          return humanBoundary(`\u23F8\uFE0F  run parked on a billing gate \u2014 top up, then: lua workflows retry-step ${runId} --step ${stepId ?? "<stepId>"}`, WORKFLOW_EXIT.RUN_PARKED);
+        }
+        if (gate === "budget") {
+          return humanBoundary(`\u23F8\uFE0F  run budget reached \u2014 lua workflows raise-budget ${runId} --credits <n> (lua workflows status ${runId} says what a credit buys)`, WORKFLOW_EXIT.RUN_PARKED);
+        }
+        return humanBoundary(`\u23F8\uFE0F  run gated (${gate ?? "consent"}) \u2014 approve it from the desktop; then: lua workflows watch ${runId}`, WORKFLOW_EXIT.RUN_GATED);
       }
       if (type === "run.suspended") {
         const kind = ev.data?.kind;
         const stepId = ev.data?.stepId ?? ev.stepId;
         if (kind === "approval" || kind === "input" || kind === "signal") {
-          if (!ctx.json) {
-            const verb = kind === "approval" ? `lua workflows approve ${runId} --approval <id> --decision approve|deny` : kind === "input" ? `lua workflows resume ${runId} --step ${stepId ?? "<stepId>"} --data <json>` : `lua workflows signal ${runId} <name> --payload <json>`;
-            console.error(`\u23F8\uFE0F  run waits for a person (${kind}${stepId ? ` \xB7 ${stepId}` : ""}) \u2014 ${verb}; then: lua workflows watch ${runId}`);
-          }
-          return WORKFLOW_EXIT.RUN_PARKED;
+          const verb = kind === "approval" ? `lua workflows approve ${runId} --approval <id> --decision approve|deny` : kind === "input" ? `lua workflows resume ${runId} --step ${stepId ?? "<stepId>"} --data <json>` : `lua workflows signal ${runId} <name> --payload <json>`;
+          return humanBoundary(`\u23F8\uFE0F  run waits for a person (${kind}${stepId ? ` \xB7 ${stepId}` : ""}) \u2014 ${verb}; then: lua workflows watch ${runId}`, WORKFLOW_EXIT.RUN_PARKED);
         }
       }
       if (type === "run.budget_parked") {
-        if (!ctx.json) console.error(`\u23F8\uFE0F  run budget reached (1 credit per agent step, 4 per Job-tier attempt) \u2014 lua workflows raise-budget ${runId} --credits <n>`);
-        return WORKFLOW_EXIT.RUN_PARKED;
+        return humanBoundary(`\u23F8\uFE0F  run budget reached \u2014 lua workflows raise-budget ${runId} --credits <n> (lua workflows status ${runId} says what a credit buys)`, WORKFLOW_EXIT.RUN_PARKED);
       }
       if (type === "run.completed") return WORKFLOW_EXIT.OK;
       if (type === "run.failed" || type === "run.timed_out") return WORKFLOW_EXIT.RUN_FAILED;
@@ -49928,6 +51257,10 @@ async function cancelCore(ctx, runId, o) {
   emitJson(ctx, res);
   if (!ctx.json) {
     const v = res.data;
+    if (v.state === "terminal" || v.cancelRequested === false && v.transitioned === false && TERMINAL2.has(v.status)) {
+      writeInfo(`\u2139\uFE0F  run ${runId} was already ${v.status} \u2014 nothing to cancel`);
+      return WORKFLOW_EXIT.OK;
+    }
     writeSuccess(`\u2705 cancel accepted \xB7 run ${runId} is ${v.status}`);
     if (v.nextAction === "cancel_again") writeInfo(`   next: cancel again to escalate \u2014 lua workflows cancel ${runId}`);
     else if (v.nextAction === "force") writeInfo(`   next: force available${v.forceAvailableAt ? ` at ${when(v.forceAvailableAt)}` : ""} \u2014 lua workflows cancel ${runId} --force`);
@@ -49980,8 +51313,8 @@ async function resumeCore(ctx, runId, o) {
   if (!ctx.json) {
     if (res.data.resumed) writeSuccess(`\u2705 resumed \xB7 run is ${res.data.runStatus}`);
     else {
-      const by = res.data.recorded?.by;
-      writeInfo(`\u2139\uFE0F  already resumed at ${when(res.data.recorded?.at)}${by ? ` by ${by.subjectType}:${by.subjectId}` : ""} \xB7 run is ${res.data.runStatus}`);
+      const by = actorLabel(res.data.recorded?.by);
+      writeInfo(`\u2139\uFE0F  already resumed at ${when(res.data.recorded?.at)}${by ? ` by ${by}` : ""} \xB7 run is ${res.data.runStatus}`);
     }
   }
   return WORKFLOW_EXIT.OK;
@@ -50014,13 +51347,20 @@ async function retryStepCore(ctx, runId, o) {
       writeSuccess(`\u2705 re-armed ${o.step} (attempt ${d.attempt}) \xB7 run is ${d.runStatus}` + (d.remainingParks ? ` \xB7 ${d.remainingParks} other parked step(s)` : ""));
     } else {
       const standing = d.reason === "already_retried" ? "retried" : `resolved${d.recorded?.outcome ? ` (${d.recorded?.outcome})` : ""}`;
-      const by = d.recorded?.by;
-      writeInfo(`\u2139\uFE0F  step "${o.step}" was already ${standing}` + (by ? ` by ${by.subjectType}:${by.subjectId}` : "") + (d.recorded?.at ? ` at ${when(d.recorded.at)}` : "") + ` \xB7 run is ${d.runStatus}`);
+      const by = actorLabel(d.recorded?.by);
+      writeInfo(`\u2139\uFE0F  step "${o.step}" was already ${standing}` + (by ? ` by ${by}` : "") + (d.recorded?.at ? ` at ${when(d.recorded.at)}` : "") + ` \xB7 run is ${d.runStatus}`);
     }
   }
   return WORKFLOW_EXIT.OK;
 }
 __name(retryStepCore, "retryStepCore");
+function approveResultLine(d) {
+  if (d.resolved) return `\u2705 ${d.outcome} \xB7 run is ${d.runStatus}`;
+  const ref = d.decidedBy;
+  const who = ref && typeof ref === "object" && ref.subjectId && ref.source ? `${ref.subjectId} via ${ref.source}` : actorLabel(ref);
+  return `\u2139\uFE0F  no-op (${d.reason})${who ? ` \u2014 decided by ${who}` : ""}`;
+}
+__name(approveResultLine, "approveResultLine");
 async function approveCore(ctx, runId, o) {
   if (!o.approval) {
     console.error("\u274C approve: --approval <id> is required");
@@ -50061,12 +51401,25 @@ async function approveCore(ctx, runId, o) {
   }
   emitJson(ctx, res);
   if (!ctx.json) {
-    if (res.data.resolved) writeSuccess(`\u2705 ${res.data.outcome} \xB7 run is ${res.data.runStatus}`);
-    else writeInfo(`\u2139\uFE0F  no-op (${res.data.reason})${res.data.decidedBy ? ` \u2014 decided by ${res.data.decidedBy}` : ""}`);
+    if (res.data.resolved) writeSuccess(approveResultLine(res.data));
+    else writeInfo(approveResultLine(res.data));
   }
   return WORKFLOW_EXIT.OK;
 }
 __name(approveCore, "approveCore");
+function actorLabel(by, now = Date.now()) {
+  if (by === void 0 || by === null) return void 0;
+  if (typeof by === "string") return by;
+  if (typeof by !== "object") return String(by);
+  const a = by;
+  const kind = a.subjectType ?? a.kind;
+  const id = a.name ?? a.subjectId ?? a.id;
+  const who = kind && id ? `${kind}:${id}` : kind ?? id;
+  if (!who) return void 0;
+  const at = typeof a.at === "number" ? a.at : typeof a.at === "string" ? Date.parse(a.at) : NaN;
+  return Number.isFinite(at) ? `${who} (${agoFrom(at, now)})` : who;
+}
+__name(actorLabel, "actorLabel");
 function reservedSecretKeyPaths(value3, path25 = "", depth = 0, out = []) {
   if (depth > 64 || out.length >= 20 || value3 === null || typeof value3 !== "object") return out;
   if (Array.isArray(value3)) {
@@ -50345,6 +51698,17 @@ async function deleteCore(ctx, name, o) {
     force: "cancel"
   } : {});
   if (!res.success) {
+    if (res.error?.statusCode === 409 && (res.error.code ?? res.error.error) === "WORKFLOW_REFERENCED_BY_JOBS") {
+      if (!ctx.json) {
+        const jobs = res.error.jobs ?? [];
+        console.error(`\u274C "${wf.name}" is still referenced by ${jobs.length} job(s) \u2014 stop them first:`);
+        for (const j of jobs) {
+          console.error(j.kind === "goal" && j.goalId ? `   \u2022 goal ${j.goalId} (job ${j.jobId}): lua workflows goals close ${j.goalId}` : `   \u2022 schedule ${j.jobId}: lua workflows schedules delete ${j.jobId}`);
+        }
+      }
+      emitJson(ctx, res);
+      return WORKFLOW_EXIT.API;
+    }
     if (res.error?.statusCode === 409 && !ctx.json) {
       const counts = res.error.counts;
       console.error(`\u274C "${wf.name}" has runs in flight${counts ? ` (${Object.entries(counts).map(([k, v]) => `${k}: ${v}`).join(", ")})` : ""} \u2014 cancel them first or pass --force`);
@@ -50678,10 +52042,14 @@ ${report.archived.length} archived \xB7 ${report.skipped.length} skipped \xB7 ${
 __name(archiveRunsCore, "archiveRunsCore");
 function ago(ms) {
   if (!ms) return "\u2014";
-  const s = Math.max(0, Math.round((Date.now() - ms) / 1e3));
-  return s < 90 ? `${s}s ago` : s < 5400 ? `${Math.round(s / 60)}m ago` : `${(s / 3600).toFixed(1)}h ago`;
+  return agoFrom(ms, Date.now());
 }
 __name(ago, "ago");
+function agoFrom(ms, now) {
+  const s = Math.max(0, Math.round((now - ms) / 1e3));
+  return s < 90 ? `${s}s ago` : s < 5400 ? `${Math.round(s / 60)}m ago` : `${(s / 3600).toFixed(1)}h ago`;
+}
+__name(agoFrom, "agoFrom");
 function printWorkspace(ws) {
   console.log(`
 \u{1F4E6} Workspace of ${ws.runId} \xB7 ${ws.status} (${ws.kind}, ${ws.backend})`);
@@ -50862,6 +52230,8 @@ var GOAL_VERBS = [
   "list",
   "get",
   "create",
+  "edit",
+  "raise",
   "pause",
   "resume",
   "close"
@@ -50903,6 +52273,10 @@ function parseIntegerFlag(v, flag, range2 = {}) {
   return n2;
 }
 __name(parseIntegerFlag, "parseIntegerFlag");
+var GOAL_LIVE_STATUSES = /* @__PURE__ */ new Set([
+  "active",
+  "paused"
+]);
 function goalScheduleRefusal(jobId, goalId) {
   return `Schedule ${jobId} is the cadence of goal ${goalId} and was NOT removed \u2014 nothing was changed. To stop the goal use \`lua workflows goals pause ${goalId}\` (it can come back) or \`lua workflows goals close ${goalId}\` (final); unscheduling a goal's job is recorded as a failure of the goal, never as stopping it.`;
 }
@@ -50927,7 +52301,12 @@ var judgeLabel = /* @__PURE__ */ __name((judge) => {
 var goalStatusLabel = /* @__PURE__ */ __name((g) => `${g.status}${g.pauseReason ? ` (${g.pauseReason})` : ""}`, "goalStatusLabel");
 var goalJobStateLabel = /* @__PURE__ */ __name((g) => g.job ? ` \xB7 ${g.job.status}${g.job.status === "active" && g.job.nextRunAt ? `, next ${when(g.job.nextRunAt)}` : ""}` : "", "goalJobStateLabel");
 var verdictLabel = /* @__PURE__ */ __name((v) => v ? `${v.done ? "done" : "continue"}${v.summary ? ` \xB7 ${v.summary.slice(0, 60)}` : ""}` : "\u2014", "verdictLabel");
-var scheduleStatus = /* @__PURE__ */ __name((r) => r.autoDisabled ? "auto-disabled" : r.status === "inactive" ? "inactive" : r.paused ? "paused" : "active", "scheduleStatus");
+var scheduleStatus = /* @__PURE__ */ __name((r) => r.autoDisabled ? "auto-disabled" : r.status === "inactive" ? "inactive" : r.status === "completed" || r.status === "missed" ? r.status : r.paused ? "paused" : "active", "scheduleStatus");
+function goalRaiseHint(goalId, reason) {
+  const flag = reason === "budget" ? "--max-credits <n>" : reason === "max_runs" ? "--max-runs <n>" : "--max-runs <n> | --max-credits <n>";
+  return `a goal parked at its cap (max_runs / budget) re-arms when the cap is raised: lua workflows goals raise ${goalId} ${flag} \u2014 or edit it: lua workflows goals edit ${goalId} \u2026`;
+}
+__name(goalRaiseHint, "goalRaiseHint");
 var errorLabel = /* @__PURE__ */ __name((e) => `${e.code ?? e.error ?? e.statusCode ?? "?"} \u2014 ${e.message}`, "errorLabel");
 async function loadGoals(ctx, workflowId) {
   const items = [];
@@ -51090,8 +52469,17 @@ function goalFailure(ctx, res, verb, ref) {
   if (!ctx.json && err) {
     if (status === 409 && code === "GOAL_NOT_ACTIVE") {
       const now = err.status ?? "not active";
-      const rule = verb === "goals resume" ? "only a paused goal resumes" : verb === "goals pause" ? "only an active goal pauses" : "a done/closed goal stays closed";
+      const rule = verb === "goals resume" ? "only a paused goal resumes" : verb === "goals pause" ? "only an active goal pauses" : "a done/closed goal stays closed (a lingering cadence Job goes with `lua workflows schedules delete <jobId>`)";
       console.error(`\u274C goal ${ref ?? ""} is ${now} \u2014 ${rule}`);
+      if (verb === "goals resume" && now === "paused") console.error(`   ${goalRaiseHint(ref ?? "<goalId>")}`);
+    } else if (status === 400 && code === "GOAL_RAISE_BELOW_SPENT") {
+      const { field, value: value3, spent } = err;
+      const flag = field === "maxRuns" ? "--max-runs" : "--max-credits";
+      const used = field === "maxRuns" ? "run(s) already used" : "credit(s) already spent";
+      console.error(`\u274C ${flag} ${value3 ?? "?"} is not above the ${spent ?? "?"} ${used} \u2014 raise it past ${spent ?? "?"}`);
+    } else if (status === 409 && code === "GOAL_VERSION_CONFLICT") {
+      const at = err.updatedAt;
+      console.error(`\u274C goal ${ref ?? ""} changed since it was read${at ? ` (updatedAt ${at})` : ""} \u2014 re-run lua workflows goals get ${ref ?? "<goalId>"} and retry${at ? ` with --if-match ${at}` : ""}`);
     } else if (status === 409 && code === "GOAL_CAP") {
       console.error(`\u274C goal cap reached (${err.cap ?? "?"} per agent) \u2014 close or finish one first: lua workflows goals list --status active`);
     } else if (status === 400 && code === "VALIDATION_FAILED") {
@@ -51119,6 +52507,8 @@ async function goalsCore(ctx, target, extra, o) {
     return WORKFLOW_EXIT.USAGE;
   }
   if (verb === "get") return goalsGetCore(ctx, extra);
+  if (verb === "edit") return goalsEditCore(ctx, extra, o);
+  if (verb === "raise") return goalsRaiseCore(ctx, extra, o);
   return goalsControlCore(ctx, verb, extra, o);
 }
 __name(goalsCore, "goalsCore");
@@ -51188,6 +52578,10 @@ function printGoalDetail(g) {
   console.log(`   Cadence:   ${cadenceLabel(g.cadence)} \xB7 mode ${g.evaluation?.mode ?? "immediate"}${g.evaluation?.delaySeconds ? ` \xB7 delay ${g.evaluation.delaySeconds}s` : ""}`);
   console.log(`   Runs:      ${g.runsUsed}/${g.maxRuns} used \xB7 iteration ${g.iteration ?? 0}${g.consecutiveContinues ? ` \xB7 ${g.consecutiveContinues} consecutive continue(s)` : ""}${g.currentRunId ? ` \xB7 current ${g.currentRunId}` : ""}`);
   if (g.budget?.maxCredits || g.maxTotalCredits) console.log(`   Budget:    ${g.budget?.maxCredits ? `per-run ${g.budget.maxCredits} credits` : ""}${g.budget?.maxCredits && g.maxTotalCredits ? " \xB7 " : ""}${g.maxTotalCredits ? `lineage cap ${g.maxTotalCredits} credits` : ""}`);
+  if (g.status === "paused" && (g.pauseReason === "budget" || g.pauseReason === "max_runs")) console.log(`   \u23F8  parked at its ${g.pauseReason === "budget" ? "credit" : "run"} cap \u2014 ${goalRaiseHint(g.goalId, g.pauseReason)}`);
+  if (g.note) console.log(`   Note:      ${g.note}`);
+  if (g.closeNote) console.log(`   Closed:    ${g.closeNote}`);
+  if (g.raises?.length) console.log(`   Raises:    ${g.raises.map((r) => `${goalCapsLabel(r.from)} \u2192 ${goalCapsLabel(r.to)} (${r.by}, ${when(r.at)}${r.note ? `, "${r.note}"` : ""})`).join(" \xB7 ")}`);
   console.log(`   Schedule:  ${g.jobId ? `${g.jobId} (goal-owned \u2014 stop it with goals pause|close, never schedules delete)${goalJobStateLabel(g)}` : "none (immediate)"}`);
   if (g.verdict) console.log(`   Verdict:   ${verdictLabel(g.verdict)}${g.verdict.runId ? ` (run ${g.verdict.runId}${g.verdict.at ? ` at ${when(g.verdict.at)}` : ""})` : ""}`);
   if (g.input !== void 0) console.log(`   Input:     ${JSON.stringify(g.input).slice(0, 500)}`);
@@ -51229,6 +52623,118 @@ async function goalsControlCore(ctx, verb, goalId, o) {
   return WORKFLOW_EXIT.OK;
 }
 __name(goalsControlCore, "goalsControlCore");
+var goalCapsLabel = /* @__PURE__ */ __name((caps) => [
+  caps.maxRuns !== void 0 ? `runs ${caps.maxRuns}` : "",
+  caps.maxTotalCredits !== void 0 ? `credits ${caps.maxTotalCredits}` : ""
+].filter(Boolean).join(" \xB7 ") || "\u2014", "goalCapsLabel");
+function parseEveryFlag(raw) {
+  const m = /^\s*(\d+)\s*(s|sec|secs|m|min|mins|h|hr|hrs)?\s*$/i.exec(String(raw));
+  if (!m) throw new WorkflowLocalUsageError("usage", `--every: expected <seconds>, <n>m or <n>h (got "${raw}")`);
+  const n2 = Number(m[1]);
+  const unit = (m[2] ?? "s").toLowerCase();
+  const seconds = unit.startsWith("h") ? n2 * 3600 : unit.startsWith("m") ? n2 * 60 : n2;
+  if (seconds < 60 || seconds % 60 !== 0) throw new WorkflowLocalUsageError("usage", `--every: the interval must be whole minutes, at least 60s (got ${seconds}s)`);
+  return [
+    {
+      type: "interval",
+      seconds
+    }
+  ];
+}
+__name(parseEveryFlag, "parseEveryFlag");
+function printGoalWriteSummary(g, past) {
+  writeSuccess(`\u2705 goal ${g.goalId} ${past} \xB7 ${goalStatusLabel(g)} \xB7 runs ${g.runsUsed}/${g.maxRuns}${g.maxTotalCredits ? ` \xB7 lineage cap ${g.maxTotalCredits} credits` : ""}${g.jobId ? ` \xB7 schedule ${g.jobId}${goalJobStateLabel(g)}` : ""}`);
+  if (g.rearmed) writeInfo("   \u21BA re-armed \u2014 the cap park cleared and the goal is active again (no backfill)");
+  if (g.resumed === false) writeInfo(`   \u26A0\uFE0F  the goal parked again (${g.pauseReason ?? "strikes"}) \u2014 see: lua workflows goals get ${g.goalId}`);
+  if (!g.rearmed && g.status === "paused" && (g.pauseReason === "budget" || g.pauseReason === "max_runs")) writeInfo(`   still parked (${g.pauseReason}) \u2014 ${goalRaiseHint(g.goalId, g.pauseReason)}`);
+}
+__name(printGoalWriteSummary, "printGoalWriteSummary");
+async function goalsEditCore(ctx, goalId, o) {
+  let dto;
+  try {
+    const usage = /* @__PURE__ */ __name((m) => new WorkflowLocalUsageError("usage", m), "usage");
+    dto = {};
+    if (o.objective !== void 0) {
+      if (!o.objective.trim()) throw usage("--objective: must not be empty");
+      dto.objective = o.objective.trim();
+    }
+    if (o.judgePredicate) dto.judge = {
+      agentId: "$self",
+      predicate: parseJudgePredicateFlag(o.judgePredicate)
+    };
+    if (o.every && o.cadence?.length) throw usage("--every and --cadence are alternatives \u2014 pass one");
+    if (o.every) dto.cadence = parseEveryFlag(o.every);
+    else if (o.cadence?.length) dto.cadence = parseCadenceFlag(o.cadence, o.timezone);
+    else if (o.timezone) throw usage("--timezone applies to a bare cron --cadence entry \u2014 none given");
+    const maxRuns = parseIntegerFlag(o.maxRuns, "--max-runs", {
+      min: 1,
+      max: GOAL_MAX_RUNS_CAP
+    });
+    if (maxRuns !== void 0) dto.maxRuns = maxRuns;
+    const rawCredits = o.maxCredits ?? o.maxTotalCredits;
+    if (rawCredits !== void 0) {
+      if (String(rawCredits).trim().toLowerCase() === "none") dto.maxTotalCredits = null;
+      else dto.maxTotalCredits = parseIntegerFlag(rawCredits, "--max-credits", {
+        min: 1
+      });
+    }
+    if (o.note !== void 0) dto.note = o.note.trim() ? o.note : null;
+    const ifMatch = parseIntegerFlag(o.ifMatch, "--if-match", {
+      min: 1
+    });
+    if (ifMatch !== void 0) dto.ifMatch = ifMatch;
+    if (Object.keys(dto).filter((k) => k !== "ifMatch").length === 0) throw usage("nothing to change \u2014 pass --objective, --judge-predicate, --cadence | --every, --max-runs, --max-credits <n|none> or --note");
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) {
+      console.error(`\u274C goals edit: ${e.message}`);
+      return WORKFLOW_EXIT.USAGE;
+    }
+    throw e;
+  }
+  const res = await ctx.api.updateGoal(goalId, dto);
+  if (!res.success || !res.data) return goalFailure(ctx, res, "goals edit", goalId);
+  emitJson(ctx, res);
+  if (!ctx.json) printGoalWriteSummary(res.data, "updated");
+  return WORKFLOW_EXIT.OK;
+}
+__name(goalsEditCore, "goalsEditCore");
+async function goalsRaiseCore(ctx, goalId, o) {
+  let dto;
+  try {
+    dto = {};
+    const maxRuns = parseIntegerFlag(o.maxRuns, "--max-runs", {
+      min: 1,
+      max: GOAL_MAX_RUNS_CAP
+    });
+    if (maxRuns !== void 0) dto.maxRuns = maxRuns;
+    const maxTotalCredits = parseIntegerFlag(o.maxCredits ?? o.maxTotalCredits, "--max-credits", {
+      min: 1
+    });
+    if (maxTotalCredits !== void 0) dto.maxTotalCredits = maxTotalCredits;
+    if (dto.maxRuns === void 0 && dto.maxTotalCredits === void 0) throw new WorkflowLocalUsageError("usage", "--max-credits <n> and/or --max-runs <n> is required (increases only)");
+    if (o.note) dto.note = o.note;
+    const ifMatch = parseIntegerFlag(o.ifMatch, "--if-match", {
+      min: 1
+    });
+    if (ifMatch !== void 0) dto.ifMatch = ifMatch;
+  } catch (e) {
+    if (e instanceof WorkflowLocalUsageError) {
+      console.error(`\u274C goals raise: ${e.message}`);
+      return WORKFLOW_EXIT.USAGE;
+    }
+    throw e;
+  }
+  const res = await ctx.api.raiseGoal(goalId, dto);
+  if (!res.success || !res.data) return goalFailure(ctx, res, "goals raise", goalId);
+  emitJson(ctx, res);
+  if (!ctx.json) {
+    const g = res.data;
+    const last = g.raises?.[g.raises.length - 1];
+    printGoalWriteSummary(g, `raised${last ? ` (${goalCapsLabel(last.from)} \u2192 ${goalCapsLabel(last.to)})` : ""}`);
+  }
+  return WORKFLOW_EXIT.OK;
+}
+__name(goalsRaiseCore, "goalsRaiseCore");
 function parseJudgePredicateFlag(raw) {
   const opList = GOAL_PREDICATE_OPS.join("|");
   if (raw.startsWith("{") || raw.startsWith("@")) {
@@ -51465,7 +52971,15 @@ async function schedulesDeleteCore(ctx, jobId, o) {
   if (!rowRes.success || !rowRes.data) return apiFailure(ctx, rowRes, "schedules delete");
   const row2 = rowRes.data;
   let goalId = row2.goalId;
-  if (!goalId) {
+  let goalStatus;
+  if (goalId) {
+    const goalRes = await ctx.api.getGoal(goalId);
+    if (goalRes.success && goalRes.data) goalStatus = goalRes.data.status;
+    else if (goalRes.error?.statusCode !== 404) {
+      if (!ctx.json) console.error(`\u274C cannot prove goal ${goalId} of ${jobId} has ended (goal unreadable) \u2014 refusing to delete`);
+      return apiFailure(ctx, goalRes, "schedules delete");
+    }
+  } else {
     const goals = await loadGoals(ctx, row2.workflowId);
     if (goals.error) {
       if (!ctx.json) console.error(`\u274C cannot prove ${jobId} is not a goal's cadence (goals unavailable) \u2014 refusing to delete`);
@@ -51474,9 +52988,11 @@ async function schedulesDeleteCore(ctx, jobId, o) {
         error: goals.error
       }, "schedules delete");
     }
-    goalId = goals.items.find((g) => g.jobId === jobId)?.goalId;
+    const owner = goals.items.find((g) => g.jobId === jobId);
+    goalId = owner?.goalId;
+    goalStatus = owner?.status;
   }
-  if (goalId) {
+  if (goalId && GOAL_LIVE_STATUSES.has(goalStatus)) {
     const message = goalScheduleRefusal(jobId, goalId);
     if (ctx.json) console.log(JSON.stringify({
       success: false,
@@ -60387,6 +61903,7 @@ import chalk4 from "chalk";
 init_compiler2();
 init_artifact_loader();
 init_analytics();
+init_cli_error();
 async function resolveCurrentModel(apiKey, agentId) {
   const serverModel = await fetchServerModel(apiKey, agentId);
   if (serverModel) return serverModel;
@@ -60450,8 +61967,9 @@ async function modelsCommand(action, opts) {
       const models = await fetchApprovedModels(apiKey, agentId);
       writeProgress("");
       if (models === null) {
-        writeError("\u274C Could not fetch models from the server. Check your connection and API key.");
-        return;
+        throw new CliError("error", "Could not fetch models from the server.", {
+          hint: "Check your connection and API key, then retry."
+        });
       }
       if (models.length === 0) {
         writeInfo("\u2139\uFE0F  No models are currently available. If your organization restricts models, an admin may need to review its excluded-models list.");
@@ -62992,23 +64510,30 @@ Examples:
   $ lua jobs versions -i myJob                         View job versions
   $ lua jobs history -i myJob                          View execution history
 `).action(jobsCommand);
-  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, approve, signal, replay)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/goals create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list: page size").option("--cursor <c>", "runs/goals list: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch: give up after s seconds (exit 7)").option("--events", "watch: print raw frames").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/logs: step id").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve: approval id").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip)").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create: cadence entry (repeatable, \u2264 5); none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create: IANA timezone for bare cron cadences").option("--max-runs <n>", "goals create: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").addHelpText("after", `
+  program2.command("workflows [action] [target] [extra]").description("\u{1F9ED} Manage workflows and their runs (list, start, watch, cancel, resume, approve, signal, replay)").option("-i, --workflow-name <name>", "Workflow name (or id)").option("-r, --run-id <id>", "Run id").option("-v, --workflow-version <ver>", "deploy/start/goals create: a semver, 'latest' (newest push) or a version id").option("--json", "Print the raw {success,data} envelope").option("--all", "list: include dynamic workflows").option("--input <json|@file>", "start/run/goals create: run input").option("--idempotency-key <key>", "start: idempotency key").option("--correlation-key <key>", "start/runs: correlation key").option("--tag <tag>", "start/runs: tag (repeatable, \u2264 10)", collect, []).option("--budget-credits <n>", "start: run budget (credits)").option("--wait <s>", "start: server long-poll \u2264 55 s").option("--follow", "start/logs: attach watch").option("--status <status>", "runs/goals list: filter by status").option("--workflow <name>", "runs: filter by workflow").option("--limit <n>", "runs/goals list: page size").option("--cursor <c>", "runs/goals list: page cursor").option("--sort <field>", "runs: -createdAt|createdAt|-durationMs|durationMs").option("--steps", "status: per-step table").option("--strict", "status: exit 4/5 by terminal status").option("--after <seq>", "watch: replay from seq").option("--timeout <s>", "watch / start --follow: give up after s seconds while the run is still live (exit 7)").option("--events", "watch: print raw frames").option("--wait-for-human", "watch / start --follow: keep following through a human boundary (approval, input, signal, park) instead of exiting 8").option("--reason <text>", "cancel: reason").option("--step <id>", "resume/logs: step id").option("--data <json|@file>", "resume: resumeData").option("--approval <id>", "approve: approval id").option("--decision <approve|deny>", "approve: decision (default approve)").option("--note <text>", "approve/goals close: note").option("--edit <json|@file>", "approve: edited payload (small inline edits)").option("--fingerprint <f>", "approve: payloadFingerprint (mandatory with --edit)").option("--payload <json|@file>", "signal: payload").option("--dedupe-key <key>", "signal: dedupe key").option("--local", "replay: replay locally against the compiled artifact").option("--since <dur>", "logs: window").option("--yes", "delete/delete-run/schedules delete: skip confirmation").option("--force", "delete: cancel in-flight runs first \xB7 run: seed from a changed graph").option("--step-output <id=json>", "run: complete a step with this output (repeatable)", collect, []).option("--approve <id[=@payload]>", "run: pre-answer an approval (repeatable)", collect, []).option("--deny <id[=@reason]>", "run: pre-deny an approval (repeatable)", collect, []).option("--signal <name=json>", "run: pre-supply a waitForSignal payload (repeatable)", collect, []).option("--from-run <runId>", "run: seed completed steps from a real run").option("--record <dir>", "run: record agent/tool outputs as fixtures").option("--fixtures <dir>", "run: replay recorded fixtures").option("--step-wall <s>", "run: per-step wall in seconds (default 600)").option("--job-wall <s>", "run: virtual wall for tier:'job' steps \u2014 splits at 14400 s segments, > 86400 is exit 2").option("--ledger-out <file>", "run: write the in-memory ledger as JSON").option("--agents <fake|live>", "run: fake agent steps (default) or call the dev API").option("--now <iso>", "run: virtual clock start").option("--park <id>", "run: simulate a platform-fault park of this step (repeatable)", collect, []).option("--fast-retries", "run: collapse retry backoff waits to 0").option("--real-time", "run: actually wait on sleeps/backoffs instead of fast-forwarding").option("--artefacts-dir <dir>", "run: back ctx.artefacts.* on disk").option("--workspace <dir>", "run: the checkout Job-tier code steps run in (ctx.workspace + ctx.exec / ctx.$)").option("--env <KEY=value>", "run: local env.template() overlay (repeatable; missing key \u21D2 exit 2)", collect, []).option("--max-ticks <n>", "run (script form): tick cap before SCRIPT_TICK_LIMIT (default 64)").option("--until <iso>", "archive-runs: window end").option("--out <dir>", "archive-runs: destination dir (archive-index.ndjson + <runId>.zip)").option("--concurrency <n>", "archive-runs: parallel exports (default 2, max 5)").option("--no-inputs", "archive-runs: exclude run inputs from the bundle").option("--no-artefacts", "archive-runs: exclude artefacts from the bundle").option("--retention-days <n>", "archive-runs: org run retention (default 90) \u2014 --since must fit retention \u2212 7 d").option("--connection <id>", "archive-runs: org storage connection for s3:// / gs:// sinks").option("--release", "workspace: release the run workspace (R42)").option("--attempt <n>", "job-logs: attempt (default latest)").option("--tail <n>", "job-logs: log lines (1..2000, default 200)").option("--objective <text>", "goals create: the objective (\u2264 2000 chars)").option("--judge-predicate <spec>", "goals create: deterministic judge \u2014 '<path> <op> [value]' (e.g. 'output.done truthy'), JSON or @file").option("--judge-agent <agentId|'$self'>", "goals create: judge agent \u2014 write '$self' quoted (or self); it needs --judge-role").option("--judge-role <json|@file>", "goals create: D25 role {name,instructions,tools} for a '$self' judge").option("--schema <json|@file>", "goals create: judge output JsonSchema (must declare a boolean `done`)").option("--cadence <cron|json|@file>", "goals create: cadence entry (repeatable, \u2264 5); none \u21D2 immediate", collect, []).option("--timezone <tz>", "goals create/edit: IANA timezone for bare cron cadences").option("--max-runs <n>", "goals create/edit/raise: iteration cap (1..100)").option("--max-total-credits <n>", "goals create: lineage-wide credit gate").option("--max-credits <n|none>", "goals edit/raise: lineage-wide credit gate (edit: none clears it)").option("--every <interval>", "goals edit: interval cadence \u2014 900, 15m, 2h (whole minutes, \u2265 60s)").option("--if-match <updatedAt>", "goals edit/raise: refuse the write if the goal changed since this updatedAt").addHelpText("after", `
 Arguments:
   action    list \xB7 view \xB7 versions \xB7 deploy \xB7 activate \xB7 deactivate \xB7 start \xB7 run \xB7 runs \xB7 status \xB7
             watch \xB7 cancel \xB7 resume \xB7 retry-step \xB7 approve \xB7 signal \xB7 replay \xB7 logs \xB7 delete \xB7 delete-run \xB7
             env-overlay \xB7 archive-runs \xB7 workspace \xB7 jobs \xB7 job-logs \xB7
-            goals <list|get|create|pause|resume|close> \xB7 schedules <list|delete>
+            goals <list|get|create|edit|raise|pause|resume|close> \xB7 schedules <list|delete>
   target    workflow name (list/view/versions/deploy/activate/deactivate/start/run/delete) or run id (the rest);
             the sub-verb for goals / schedules
-  extra     signal name (signal <runId> <name>) \xB7 goal id (goals get/pause/resume/close) \xB7 job id (schedules delete)
+  extra     signal name (signal <runId> <name>) \xB7 goal id (goals get/edit/raise/pause/resume/close) \xB7 job id (schedules delete)
 
-Exit codes: 0 ok \xB7 1 API failure \xB7 2 usage \xB7 3 not found \xB7 4 run failed \xB7 5 run cancelled \xB7
-            6 run gated (consent) \xB7 7 --timeout reached \xB7 8 run parked (exception/budget gate)
+Exit codes: 0 ok \xB7 1 API refusal (a 4xx other than 404) \xB7 2 usage \xB7 3 not found \xB7 4 run failed \xB7 5 run cancelled \xB7
+            6 run gated (consent) \xB7 7 --timeout reached \xB7 8 run parked \u2014 waiting for a human
+            (approval \xB7 input \xB7 signal \xB7 billing / budget / exception park; the resuming verb is printed).
+            start --follow and watch EXIT at a human boundary (8, or 6 on a consent gate) unless
+            --wait-for-human; a terminal run exits 0 completed \xB7 4 failed/timed out \xB7 5 cancelled.
+            A failed request and every escaped error use the global classes: 9 auth (401) \xB7 10 forbidden (403) \xB7
+            11 unavailable (5xx / connection refused / timeout) \u2014 one line, \u2716 <code>: <message>; LUA_DEBUG=1
+            prints the stack.
 
 Examples:
   $ lua workflows list
   $ lua workflows run outreach --input @leads.json --step-output draftEmail=@draft.json --approve reviewDrafts
   $ lua workflows start outreach --input '{"leads":[]}' --follow
+  $ lua workflows start outreach --follow --wait-for-human --timeout 3600
   $ lua workflows runs --workflow outreach --status failed
   $ lua workflows status <runId> --steps
   $ lua workflows watch <runId> --timeout 600
@@ -63029,6 +64554,8 @@ Examples:
   $ lua workflows goals get wfg_1234
   $ lua workflows goals create -i outreach --objective "Reach 50 signups" --judge-predicate 'output.signups gte 50' \\
       --cadence '0 9 * * 1' --timezone Europe/London --max-runs 12 --input '{"segment":"trial"}'
+  $ lua workflows goals edit wfg_1234 --max-credits 500 --every 30m --note "widened after the launch"
+  $ lua workflows goals raise wfg_1234 --max-runs 24        (a goal parked max_runs / budget re-arms when its cap clears)
   $ lua workflows goals pause wfg_1234 \xB7 goals resume wfg_1234 \xB7 goals close wfg_1234 --note "shipped"
   $ lua workflows schedules list -i outreach
   $ lua workflows schedules delete <jobId> --yes     (a goal's cadence is refused: goal_schedule)
@@ -63370,6 +64897,7 @@ __name(setupSkillCommands, "setupSkillCommands");
 
 // src/index.ts
 init_cli();
+init_cli_error();
 
 // src/utils/banner.ts
 var BOLD = "\x1B[1m";
@@ -63414,8 +64942,9 @@ if (isBareInvocation || isHelpInvocation) {
     version: CLI_VERSION
   });
 }
+if (args.includes("--debug") || debugEnabled()) setDebugMode(true);
 var program = new Command();
-program.showSuggestionAfterError().name("lua").description("Lua AI - Build and deploy AI agents with superpowers").version(CLI_VERSION, "-V, --cli-version").option("--ci", "CI/CD mode: fail loudly on missing required flags instead of prompting").addHelpText("after", `
+program.exitOverride().showSuggestionAfterError().name("lua").description("Lua AI - Build and deploy AI agents with superpowers").version(CLI_VERSION, "-V, --cli-version").option("--ci", "CI/CD mode: fail loudly on missing required flags instead of prompting").addHelpText("after", `
 Categories:
   \u{1F510} Authentication    Manage API keys and authentication
   \u{1F680} Project Setup     Initialize and configure projects
@@ -63460,6 +64989,8 @@ Examples:
   $ lua marketplace        \u{1F6CD}\uFE0F Interact with the Lua Marketplace (skills & agent templates)
   $ lua marketplace template \u{1F9E9} Create, publish, and apply marketplace agent templates
  
+${CLI_EXIT_CODE_HELP}
+
  \u{1F319} Documentation: https://docs.heylua.ai
  \u{1F319} Support: https://heylua.ai/support
 `);
@@ -63477,5 +65008,7 @@ if (rawArgs.length === 1 && rawArgs[0] === "--version") {
   console.log(CLI_VERSION);
   process.exit(0);
 }
-program.parse(process.argv);
+program.parseAsync(process.argv).catch((error) => {
+  reportUnhandledCliError(error);
+});
 //# sourceMappingURL=index.js.map